Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10824 State: PUBLISHED Published: 2018-10-17T14:00:00 Last Updated: 2024-08-05T07:46:46.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices. The administrative password is stored in plaintext in the /tmp/csman/0 file. An attacker having a directory traversal (or LFI) can easily get full router access. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/36 - http://sploit.tech/2018/10/12/
- CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Oct/36 - http://sploit.tech/2018/10/12/D-Link.html
CVE ID: CVE-2018-10825 State: PUBLISHED Published: 2018-05-15T04:00:00 Last Updated: 2024-08-05T07:46:47.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turtle to a Lilypad, which allows attackers to inject fake information about the position and temperature of a baby via a replay or spoofing attack. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40victor_14768/mimo-baby-hack-ac7fa0ae3bfb
CVE ID: CVE-2018-10827 State: PUBLISHED Published: 2018-05-09T04:00:00 Last Updated: 2024-08-05T07:46:47.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiteCart before 2.1.2 allows remote attackers to cause a denial of service (memory consumption) via URIs that do not exist, because public_html/logs/not_found.log grows without bound, and is loaded into memory for each request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/litecart/litecart/issues/119
CVE ID: CVE-2018-10828 State: PUBLISHED Published: 2018-05-09T18:00:00 Last Updated: 2024-08-05T07:46:47.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the "ApMsgFwd File Mapping Object" section. ApMsgFwd.exe uses the data written to this section as arguments to functions. This causes a denial of service condition when invalid pointers are written to the mapped section. This driver has been used with Dell, ThinkPad, and VAIO devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44610/ - https://g
Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44610/ - https://github.com/SouhailHammou/Exploits/blob/master/CVE-2018-10828/apmsgfwd_exploit_dos.c - http://support.lenovo.com/us/en/solutions/LEN-25654
CVE ID: CVE-2018-10830 State: PUBLISHED Published: 2018-05-09T07:00:00 Last Updated: 2024-08-05T07:46:47.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x002220e0. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44615/ - https://github.com/anhkgg/poc/tree/master/2345%20security%20guard/2345BdPcSafe.sys-x64-0x002220e0
CVE ID: CVE-2018-10831 State: PUBLISHED Published: 2018-05-09T05:00:00 Last Updated: 2024-08-05T07:46:47.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with {x1=1,x2=1,x3=1,...,x512=1} to bypass this verifier for any blockheader. This originally affected (for example) the Bitcoin Gold and Zcash cryptocurrencies, and continued to be exploited in the wild in May 2018 against smaller cryptocurrencies. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/edwardz246003/misc/blob/master/Attackers%2
onal Analyst Notes: - CVE Program Container: References: - https://github.com/edwardz246003/misc/blob/master/Attackers%20Fake%20Computational%20Power%20to%20Steal%20Cryptocurrencies%20from%20Mining%20Pools.md - https://blog.zencash.com/update-for-the-equihash-mining-application-z-nomp/
CVE ID: CVE-2018-10832 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T07:46:47.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html - https://www.ex
rences: - http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html - https://www.exploit-db.com/exploits/44607/
CVE ID: CVE-2018-10839 State: PUBLISHED Published: 2018-10-16T14:00:00 Last Updated: 2024-08-05T07:46:47.471Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: The QEMU Project Products: Qemu-kvm Problem Types: CWE-121 Description: Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839 - https://www.debian.org
CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10839 - https://www.debian.org/security/2018/dsa-4338 - https://usn.ubuntu.com/3826-1/ - https://www.openwall.com/lists/oss-security/2018/10/08/1 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03273.html - https://access.redhat.com/errata/RHSA-2019:2892
CVE ID: CVE-2018-10840 State: PUBLISHED Published: 2018-07-16T20:00:00 Last Updated: 2024-08-05T07:46:47.078Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: kernel Products: heap-based buffer overflow in fs/ext4/xattr.c Problem Types: CWE-122 Description: Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3752-2/ - https://usn.ubuntu.com/3752-3/ - https://access.redhat.com/errata/RHSA-2019:0162 - https://bugzilla.redhat.com/show_bug
https://usn.ubuntu.com/3752-3/ - https://access.redhat.com/errata/RHSA-2019:0162 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10840 - http://www.securityfocus.com/bid/104858 - https://usn.ubuntu.com/3752-1/
CVE ID: CVE-2018-10841 State: PUBLISHED Published: 2018-06-20T18:00:00 Last Updated: 2024-08-05T07:46:47.063Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: glusterfs Problem Types: CWE-288 Description: glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-201
es. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841 - https://access.redhat.com/errata/RHSA-2018:1955 - https://review.gluster.org/#/c/20328/ - https://access.redhat.com/errata/RHSA-2018:1954 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-10842 State: REJECTED Published: 2018-08-13T17:00:00 Last Updated: 2019-11-20T16:00:39 Description: No description available.
CVE ID: CVE-2018-10843 State: PUBLISHED Published: 2018-07-02T17:00:00 Last Updated: 2024-08-05T07:46:46.958Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: source-to-image Problem Types: CWE-20 Description: source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user. Additional Analyst Notes: - CVE Program
bly other actions, on the host which are normally only available to a root user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10843 - https://access.redhat.com/errata/RHSA-2018:2013
CVE ID: CVE-2018-10844 State: PUBLISHED Published: 2018-08-22T13:00:00 Last Updated: 2024-08-05T07:46:46.944Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: gnutls Problem Types: CWE-385 Description: It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2018/747 - https://gitlab.com/gnutls/gnutls/merge_requests/657 - https://access.re
References: - https://eprint.iacr.org/2018/747 - https://gitlab.com/gnutls/gnutls/merge_requests/657 - https://access.redhat.com/errata/RHSA-2018:3505 - http://www.securityfocus.com/bid/105138 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844 - https://access.redhat.com/errata/RHSA-2018:3050 - https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html - https://usn.ubuntu.com/3999-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
CVE ID: CVE-2018-10845 State: PUBLISHED Published: 2018-08-22T13:00:00 Last Updated: 2024-08-05T07:46:47.470Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: gnutls Problem Types: CWE-385 Description: It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845 - https://eprint.iacr.org/2018/747 - https://g
References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845 - https://eprint.iacr.org/2018/747 - https://gitlab.com/gnutls/gnutls/merge_requests/657 - https://access.redhat.com/errata/RHSA-2018:3505 - http://www.securityfocus.com/bid/105138 - https://access.redhat.com/errata/RHSA-2018:3050 - https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html - https://usn.ubuntu.com/3999-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
CVE ID: CVE-2018-10846 State: PUBLISHED Published: 2018-08-22T13:00:00 Last Updated: 2024-08-05T07:46:47.512Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: gnutls Problem Types: CWE-385 Description: A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2018/747 - https://gitlab.com/gnutls/gnutls/merge_requests/657 - https://acces
er: References: - https://eprint.iacr.org/2018/747 - https://gitlab.com/gnutls/gnutls/merge_requests/657 - https://access.redhat.com/errata/RHSA-2018:3505 - http://www.securityfocus.com/bid/105138 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10846 - https://access.redhat.com/errata/RHSA-2018:3050 - https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html - https://usn.ubuntu.com/3999-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
CVE ID: CVE-2018-10847 State: PUBLISHED Published: 2018-07-30T16:00:00 Last Updated: 2024-08-05T07:46:47.419Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: prosody Problem Types: CWE-592 Description: prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance. Additional Analyst Notes: - CVE Program Container: References: - https://issues.prosody.im/1147 - https://blog.prosody.i
Additional Analyst Notes: - CVE Program Container: References: - https://issues.prosody.im/1147 - https://blog.prosody.im/prosody-0-10-2-security-release/ - https://www.debian.org/security/2018/dsa-4216 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10847 - https://prosody.im/security/advisory_20180531/
CVE ID: CVE-2018-10848 State: REJECTED Published: 2018-06-25T03:00:00 Last Updated: 2018-06-25T03:57:01 Description: No description available.
CVE ID: CVE-2018-10849 State: REJECTED Published: 2018-06-25T03:00:00 Last Updated: 2018-06-25T03:57:01 Description: No description available.
CVE ID: CVE-2018-10850 State: PUBLISHED Published: 2018-06-13T20:00:00 Last Updated: 2024-08-05T07:46:47.455Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: 389-ds-base Problem Types: CWE-362 Description: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2757 - https://pagure.io/389-ds-base/issue/49768 - https://pagure.io/389-ds-ba
ttps://access.redhat.com/errata/RHSA-2018:2757 - https://pagure.io/389-ds-base/issue/49768 - https://pagure.io/389-ds-base/c/8f04487f99a - https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10850 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html
CVE ID: CVE-2018-10851 State: PUBLISHED Published: 2018-11-29T18:00:00 Last Updated: 2024-08-05T07:46:47.415Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The PowerDNS Project Products: pdns, pdns-recursor Problem Types: CWE-400 Description: PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html - https://doc.powerdns.c
erences: - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-04.html - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-03.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10851
CVE ID: CVE-2018-10852 State: PUBLISHED Published: 2018-06-26T14:00:00 Last Updated: 2024-08-05T07:46:47.244Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: sssd Problem Types: CWE-200 Description: The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00019.html - https://b
s: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00019.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10852 - https://access.redhat.com/errata/RHSA-2018:3158 - http://www.securityfocus.com/bid/104547
CVE ID: CVE-2018-10853 State: PUBLISHED Published: 2018-09-11T14:00:00 Last Updated: 2024-08-05T07:46:47.491Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: kernel Problem Types: CWE-250 Description: A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - ht
st Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10853 - https://usn.ubuntu.com/3777-1/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=129a72a0d3c8e139a04512325384fe5ac119e74 - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://usn.ubuntu.com/3777-2/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c9fa24ca7c9c47605672916491f79e8ccacb9e6 - https://www.openwall.com/lists/oss-security/2018/09/02/1 - http://lists.open
=3c9fa24ca7c9c47605672916491f79e8ccacb9e6 - https://www.openwall.com/lists/oss-security/2018/09/02/1 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://access.redhat.com/errata/RHSA-2020:0036 - https://access.redhat.com/errata/RHSA-2020:0103 - https://access.redhat.com/errata/RHSA-2020:0179
CVE ID: CVE-2018-10854 State: PUBLISHED Published: 2019-11-22T11:51:08 Last Updated: 2024-08-05T07:46:47.233Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: cloudforms Problem Types: CWE-79 Description: cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854
CVE ID: CVE-2018-10855 State: PUBLISHED Published: 2018-07-02T18:00:00 Last Updated: 2024-08-05T07:46:47.397Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: ansible Problem Types: CWE-532 Description: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-20
nning Ansible. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1949 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855 - https://access.redhat.com/errata/RHBA-2018:3788 - https://access.redhat.com/errata/RHSA-2018:1948 - https://access.redhat.com/errata/RHSA-2018:2184 - https://access.redhat.com/errata/RHSA-2018:2022 - https://access.redhat.com/errata/RHSA-2019:0054 - https://access.redhat.com/errata/RHSA-2018:2079 - https://access.redhat.com/errata/RHSA-2018:2585 - https://www.debian.org/security/2019/dsa-4396 - https://usn.ubuntu.com/4072-1/
CVE ID: CVE-2018-10856 State: PUBLISHED Published: 2018-07-02T18:00:00 Last Updated: 2024-08-05T07:46:47.230Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: podman Problem Types: CWE-250 Description: It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856 - https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24 - https://access.redhat.com/er
- https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24 - https://access.redhat.com/errata/RHSA-2018:2037
CVE ID: CVE-2018-10857 State: PUBLISHED Published: 2018-07-16T20:00:00 Last Updated: 2024-08-05T07:46:47.326Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: git-annex Problem Types: CWE-200 Description: git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10857
CVE ID: CVE-2018-10858 State: PUBLISHED Published: 2018-08-22T17:00:00 Last Updated: 2024-08-05T07:46:46.959Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: The Samba Team Products: samba Problem Types: CWE-20 Description: A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4271 - https://access.redhat.com/errata/RHSA-2018:2613 - https:/