Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7631 State: PUBLISHED Published: 2018-03-27T21:00:00Z Last Updated: 2024-09-17T01:51:45.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-23
CVE ID: CVE-2017-7632 State: PUBLISHED Published: 2018-03-27T21:00:00Z Last Updated: 2024-09-16T19:19:18.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-23
CVE ID: CVE-2017-7633 State: PUBLISHED Published: 2018-03-05T17:00:00Z Last Updated: 2024-09-16T22:30:54.342Z Vendors: QNAP Products: Qfinder Pro Problem Types: Missing Encryption of Sensitive Data Description: QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201802-27
CVE ID: CVE-2017-7634 State: PUBLISHED Published: 2018-03-08T14:00:00Z Last Updated: 2024-09-16T20:11:44.263Z Vendors: QNAP Products: QNAP Media Streaming Add-On Problem Types: Cross-site scripting Description: Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-08
CVE ID: CVE-2017-7635 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T16:12:27.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/nas-201806-01 - http://www.securitytracker.com/id/1041025
CVE ID: CVE-2017-7636 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T16:12:27.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/nas-201806-01 - http://www.securitytracker.com/id/1041025
CVE ID: CVE-2017-7637 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T16:12:27.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/nas-201806-01 - http://www.securitytracker.com/id/1041025
CVE ID: CVE-2017-7638 State: PUBLISHED Published: 2018-03-08T14:00:00Z Last Updated: 2024-09-17T02:36:29.376Z Vendors: QNAP Products: QNAP Media Streaming Add-On Problem Types: Incorrect Access Control Description: QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-08
CVE ID: CVE-2017-7639 State: PUBLISHED Published: 2018-06-05T21:00:00 Last Updated: 2024-08-05T16:12:27.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of Proxy Server. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/nas-201806-01 - http://www.securitytracker.com/id/1041025
CVE ID: CVE-2017-7640 State: PUBLISHED Published: 2018-03-08T14:00:00Z Last Updated: 2024-09-17T01:51:04.002Z Vendors: QNAP Products: QNAP Media Streaming Add-On Problem Types: OS Command Injection Description: QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-08
CVE ID: CVE-2017-7641 State: PUBLISHED Published: 2018-03-08T14:00:00Z Last Updated: 2024-09-17T03:23:51.133Z Vendors: QNAP Products: QNAP Media Streaming Add-On Problem Types: Cross-site request forgery Description: QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/zh-tw/security-advisory/nas-201803-08
CVE ID: CVE-2017-7642 State: PUBLISHED Published: 2017-08-02T19:00:00 Last Updated: 2024-08-05T16:12:27.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/Jul/29 - https://github.com/hashicorp/vagrant-plugin-changelog/blob/master/vagrant-vmware-changelog.md - https://www.exploit-db.com/exploits/42334/ - https://m4.rkw.io/blog/cve20177642
lob/master/vagrant-vmware-changelog.md - https://www.exploit-db.com/exploits/42334/ - https://m4.rkw.io/blog/cve20177642-local-root-privesc-in-hashicorp-vagrantvmwarefusion--4020.html
CVE ID: CVE-2017-7643 State: PUBLISHED Published: 2017-04-14T14:00:00 Last Updated: 2024-08-05T16:12:27.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid program. Additional Analyst Notes: - CVE Program Container: References: - https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html - http://seclists.org/fulldisclosure/2017/Apr/54 - https://www.exploit-db.com/exploits/41854/
CVE ID: CVE-2017-7644 State: PUBLISHED Published: 2017-04-29T00:00:00 Last Updated: 2024-08-05T16:12:28.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation, aka PAN-SA-2017-0013 and PAN-70541. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2017-7644
CVE ID: CVE-2017-7645 State: PUBLISHED Published: 2017-04-18T14:00:00 Last Updated: 2024-08-05T16:12:27.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=linux-nfs&m=149247516212924&w=2 - https://access.redhat.com/errata/RHSA-2017:1615 - https://usn.ubuntu.com/3754-1/ - https://access.redhat.com/errata/RHSA-2017:1647 - https://access.redhat.com/errata/RHSA-
ttps://usn.ubuntu.com/3754-1/ - https://access.redhat.com/errata/RHSA-2017:1647 - https://access.redhat.com/errata/RHSA-2017:1616 - https://access.redhat.com/errata/RHSA-2018:1319 - https://github.com/torvalds/linux/commit/e6838a29ecb484c97e4efef9429643b9851fba6e - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - http://www.securityfocus.com/bid/97950 - https://marc.info/?l=linux-nfs&m=149218228327497&w=2 - http://www.debian.org/security/2017/dsa-3886 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6838a29ecb484c97e4efef9429643b9851fba6e
CVE ID: CVE-2017-7646 State: PUBLISHED Published: 2017-04-10T19:00:00Z Last Updated: 2024-09-17T00:36:30.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the contents of arbitrary files contained within. Additional Analyst Notes: - CVE Program Container: References: - https://thwack.solarwinds.com/thread/111223
CVE ID: CVE-2017-7647 State: PUBLISHED Published: 2017-04-10T19:00:00Z Last Updated: 2024-09-16T23:31:45.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://thwack.solarwinds.com/thread/111223
CVE ID: CVE-2017-7648 State: PUBLISHED Published: 2017-04-10T19:00:00Z Last Updated: 2024-09-16T20:02:45.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/540388/30/0/threaded
CVE ID: CVE-2017-7649 State: PUBLISHED Published: 2017-09-11T16:00:00Z Last Updated: 2024-09-16T17:34:17.160Z Vendors: Eclipse Foundation Products: Eclipse Kura Installer Problem Types: privileged remote code execution Description: The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mo
he process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681 - https://github.com/eclipse/kura/issues/956
CVE ID: CVE-2017-7650 State: PUBLISHED Published: 2017-09-11T16:00:00Z Last Updated: 2024-09-16T20:43:01.173Z Vendors: Eclipse Foundation Products: Mosquitto Problem Types: loss of confidentiality Description: In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto. Additional Analyst Notes: - CVE Program Container: References: - http://mosquitto.org/2017/05/security-advisory-cve-2017-7650/ - http://www.securityfocus.com/bid/98
ainer: References: - http://mosquitto.org/2017/05/security-advisory-cve-2017-7650/ - http://www.securityfocus.com/bid/98741 - http://www.debian.org/security/2017/dsa-3865 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=516765
CVE ID: CVE-2017-7651 State: PUBLISHED Published: 2018-04-24T14:00:00 Last Updated: 2024-08-05T16:12:27.908Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-789 Description: In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html - https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ - https://lists.debian.org/debian-lts-anno
s://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html - https://www.debian.org/security/2018/dsa-4325 - https://bugs.eclipse.org/bugs/show_bug.cgi?id=529754
CVE ID: CVE-2017-7652 State: PUBLISHED Published: 2018-04-25T13:00:00 Last Updated: 2024-08-05T16:12:27.742Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-789 Description: In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-annou
le will fail. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html - https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102 - https://www.debian.org/security/2018/dsa-4325
CVE ID: CVE-2017-7653 State: PUBLISHED Published: 2018-06-05T20:00:00 Last Updated: 2024-08-05T16:12:27.869Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-20 Description: The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=532113 - http://docs.oasis-open.org/mqtt/disallowed-chars/v1
References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=532113 - http://docs.oasis-open.org/mqtt/disallowed-chars/v1.0/disallowed-chars-v1.0.pdf - https://lists.debian.org/debian-lts-announce/2018/09/msg00036.html - https://www.debian.org/security/2018/dsa-4325 - https://usn.ubuntu.com/4023-1/
CVE ID: CVE-2017-7654 State: PUBLISHED Published: 2018-06-05T20:00:00 Last Updated: 2024-08-05T16:12:27.955Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-401 Description: In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=533493 - https://lists.debian.org/debian-lts-announce/2018/09/msg00036.html - https://www.debian.org/security/2018/dsa-4325 - https://usn.ubuntu.com/4023-1/
CVE ID: CVE-2017-7655 State: PUBLISHED Published: 2019-03-27T19:20:36 Last Updated: 2024-08-05T16:12:27.944Z Vendors: The Eclipse Foundation Products: Eclipse Mosquitto Problem Types: CWE-476 Description: In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those applications using the library. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=533775 - https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00022.html
CVE ID: CVE-2017-7656 State: PUBLISHED Published: 2018-06-26T15:00:00 Last Updated: 2024-08-05T16:12:27.819Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-444 Description: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as H
ed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4278 - http://www.securitytracker.com/id/1041194 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apach
d.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://lists.apache.org/thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6%40%3Cissues.maven.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667 - https://security.netapp.com/advisory/ntap-20181014-0001/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en
visory/ntap-20181014-0001/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2017-7657 State: PUBLISHED Published: 2018-06-26T16:00:00 Last Updated: 2024-08-05T16:12:27.850Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-444 Description: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary all
ipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4278 - http://www.securitytracker.com/id/1041194 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:0910 - https://li
c16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:0910 - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181014-0001/ - h
- https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181014-0001/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us - https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668 - https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com//security-alerts
eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2017-7658 State: PUBLISHED Published: 2018-06-26T17:00:00 Last Updated: 2024-08-05T16:12:27.826Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-444 Description: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the interme
still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4278 - http://www.securitytracker.com/id/1041194 - http://www.securityfocus.com/bid/106566 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org
l/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181014-0001/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&doc