Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-2576 State: PUBLISHED Published: 2017-01-20T08:39:00 Last Updated: 2024-08-05T13:55:06.278Z Vendors: n/a Products: Moodle 2.x and 3.x Problem Types: unspecified Description: In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95649 - https://moodle.org/mod/forum/discuss.php?d=345912
CVE ID: CVE-2017-2577 State: REJECTED Published: 2017-03-24T10:00:00 Last Updated: 2017-03-24T07:57:01 Description: No description available.
CVE ID: CVE-2017-2578 State: PUBLISHED Published: 2017-01-20T08:39:00 Last Updated: 2024-08-05T13:55:06.094Z Vendors: n/a Products: Moodle 3.x Problem Types: unspecified Description: In Moodle 3.x, there is XSS in the assignment submission page. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=345915 - http://www.securityfocus.com/bid/95647
CVE ID: CVE-2017-2579 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T13:55:06.086Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Netpbm Products: netpbm Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insufficient code value check, so that a maliciously crafted file could cause the application to crash or possibly allows code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2579 - http://www.securityfocus.com/bid/96714 - http://lists.opensuse.org/opensuse-s
redhat.com/show_bug.cgi?id=CVE-2017-2579 - http://www.securityfocus.com/bid/96714 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00056.html
CVE ID: CVE-2017-2580 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T13:55:06.091Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Netpbm Products: netpbm Problem Types: CWE-787 Description: An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96712 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2580 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00056.html
CVE ID: CVE-2017-2581 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T13:55:06.057Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Netpbm Products: netpbm Problem Types: CWE-787 Description: An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the application to crash or possibly allow code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2581 - http://www.securityfocus.com/bid/96710
CVE ID: CVE-2017-2582 State: PUBLISHED Published: 2018-07-26T17:00:00 Last Updated: 2024-08-05T13:55:06.197Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-201 Description: It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. Additional Analyst Notes: - CVE P
n system property which could be obtained in the "InResponseTo" field in the response. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3220 - https://access.redhat.com/errata/RHSA-2017:3216 - https://access.redhat.com/errata/RHSA-2017:2809 - https://access.redhat.com/errata/RHSA-2018:2740 - https://access.redhat.com/errata/RHSA-2017:3218 - https://access.redhat.com/errata/RHSA-2017:2810 - https://access.redhat.com/errata/RHSA-2018:2741 - https://access.redhat.com/errata/RHSA-2018:2742 - https://access.redhat.com/errata/RHSA-2017:2808 - https://access.redhat.com/errata/RHSA-2019:0137 - https://access.redhat.com/errata/RHSA-2017:3219
rata/RHSA-2017:2808 - https://access.redhat.com/errata/RHSA-2019:0137 - https://access.redhat.com/errata/RHSA-2017:3219 - https://access.redhat.com/errata/RHSA-2019:0139 - https://github.com/keycloak/keycloak/pull/3715/commits/0cb5ba0f6e83162d221681f47b470c3042eef237 - http://www.securitytracker.com/id/1041707 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2582 - https://access.redhat.com/errata/RHSA-2019:0136 - https://access.redhat.com/errata/RHSA-2018:2743 - https://access.redhat.com/errata/RHSA-2017:3217 - https://access.redhat.com/errata/RHSA-2017:2811 - http://www.securityfocus.com/bid/101046
CVE ID: CVE-2017-2583 State: PUBLISHED Published: 2017-02-06T06:04:00 Last Updated: 2024-08-05T13:55:06.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL selector" instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1414735 - https://github.com/torvalds/linux/commit/33ab91103b3415e12457e3104f0e4517ce12d0f3 - https://access.redhat.com/errata/RHSA-2
ps://github.com/torvalds/linux/commit/33ab91103b3415e12457e3104f0e4517ce12d0f3 - https://access.redhat.com/errata/RHSA-2017:1615 - http://www.openwall.com/lists/oss-security/2017/01/19/2 - https://usn.ubuntu.com/3754-1/ - http://www.securityfocus.com/bid/95673 - https://access.redhat.com/errata/RHSA-2017:1616 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=33ab91103b3415e12457e3104f0e4517ce12d0f3 - http://www.debian.org/security/2017/dsa-3791 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.5
CVE ID: CVE-2017-2584 State: PUBLISHED Published: 2017-01-15T02:00:00 Last Updated: 2024-08-05T13:55:06.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95430 - http://www.securitytracker.com/id/1037603 - https://usn.ubuntu.com/3754-1/ - https://github.com/torvalds/linux/commit/129a72a0d3c8e139a04512325384fe5ac11
/1037603 - https://usn.ubuntu.com/3754-1/ - https://github.com/torvalds/linux/commit/129a72a0d3c8e139a04512325384fe5ac119e74d - http://www.debian.org/security/2017/dsa-3791 - http://www.openwall.com/lists/oss-security/2017/01/13/7 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=129a72a0d3c8e139a04512325384fe5ac119e74d - https://bugzilla.redhat.com/show_bug.cgi?id=1413001
CVE ID: CVE-2017-2585 State: PUBLISHED Published: 2018-03-12T15:00:00Z Last Updated: 2024-09-16T22:56:17.924Z Vendors: Red Hat, Inc. Products: keycloak Problem Types: None Description: Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0876.html - http://www.securitytracker.com/id/1038180 - https://bugzilla.redhat.com/show_bug.cgi?id=1412376 - http://www.securityfocus.com/bid/97393 - https://access.redhat.com/errata/RHSA-2017:0873
t.com/show_bug.cgi?id=1412376 - http://www.securityfocus.com/bid/97393 - https://access.redhat.com/errata/RHSA-2017:0873 - https://access.redhat.com/errata/RHSA-2017:0872
CVE ID: CVE-2017-2586 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T13:55:06.122Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Netpbm Products: netpbm Problem Types: CWE-476 Description: A null pointer dereference vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96708 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2586
CVE ID: CVE-2017-2587 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T13:55:06.213Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Netpbm Products: netpbm Problem Types: CWE-770 Description: A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96702 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2587
CVE ID: CVE-2017-2588 State: REJECTED Published: 2022-08-08T18:52:24 Last Updated: 2022-08-08T18:52:24 Description: No description available.
CVE ID: CVE-2017-2589 State: PUBLISHED Published: 2018-07-26T15:00:00 Last Updated: 2024-08-05T14:02:06.497Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Red Hat Products: hawtio Problem Types: CWE-285 Description: It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1832 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017
er: References: - https://access.redhat.com/errata/RHSA-2017:1832 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589
CVE ID: CVE-2017-2590 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:06.518Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Red Hat Products: ipa Problem Types: CWE-732 Description: A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys. Additional Analyst Notes: - CVE Program Container: References: - http://www
, OCSP signing, and deletion of secret keys. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96557 - http://rhn.redhat.com/errata/RHSA-2017-0388.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2590
CVE ID: CVE-2017-2591 State: PUBLISHED Published: 2018-04-30T12:00:00 Last Updated: 2024-08-05T14:02:06.992Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: unspecified Products: 389-ds-base Problem Types: CWE-122 Description: 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.i
riggering a crash of the LDAP service. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/389-ds-base/issue/48986 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591 - http://www.securityfocus.com/bid/95670
CVE ID: CVE-2017-2592 State: PUBLISHED Published: 2018-05-08T17:00:00 Last Updated: 2024-08-05T14:02:06.483Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: unspecified Products: python-oslo-middleware Problem Types: CWE-532 Description: python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens). Additional Analyst Notes: - CVE Program Container: References: - https://review.opensta
(for example, keystone tokens). Additional Analyst Notes: - CVE Program Container: References: - https://review.openstack.org/#/c/425732/ - http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html - http://rhn.redhat.com/errata/RHSA-2017-0300.html - https://access.redhat.com/errata/RHSA-2017:0300 - http://rhn.redhat.com/errata/RHSA-2017-0435.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592 - http://www.securityfocus.com/bid/95827 - https://review.openstack.org/#/c/425730/ - https://review.openstack.org/#/c/425734/ - https://bugs.launchpad.net/keystonemiddleware/+bug/1628031 - https://access.redhat.com/errata/RHSA-2017:0435 - https://usn.ubuntu.com/366
chpad.net/keystonemiddleware/+bug/1628031 - https://access.redhat.com/errata/RHSA-2017:0435 - https://usn.ubuntu.com/3666-1/
CVE ID: CVE-2017-2593 State: REJECTED Published: 2022-08-08T18:52:26 Last Updated: 2022-08-08T18:52:26 Description: No description available.
CVE ID: CVE-2017-2594 State: PUBLISHED Published: 2018-05-08T17:00:00 Last Updated: 2024-08-05T14:02:06.485Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: unspecified Products: hawtio Problem Types: CWE-209 Description: hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594 - https://access.redhat.com/errata/RHSA-2017:1832 - htt
ces: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2594 - https://access.redhat.com/errata/RHSA-2017:1832 - http://www.securityfocus.com/bid/95793
CVE ID: CVE-2017-2595 State: PUBLISHED Published: 2018-07-27T15:00:00 Last Updated: 2024-08-05T14:02:06.518Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: wildfly Problem Types: CWE-22 Description: It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1411 - http://rhn.redhat.com/errata/RHSA-2017-1409.html - https://access.redhat.com/errata/RHSA-2017:1548 - https://access.redhat.com/errata/RHSA-2017:1549 - https://access.redhat.com/e
/access.redhat.com/errata/RHSA-2017:1548 - https://access.redhat.com/errata/RHSA-2017:1549 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2017:1552 - http://www.securitytracker.com/id/1038757 - https://access.redhat.com/errata/RHSA-2017:1410 - https://access.redhat.com/errata/RHSA-2017:1412 - http://rhn.redhat.com/errata/RHSA-2017-1551.html - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - http://www.securityfocus.com/bid/98967 - https://access.redhat.com/errata/RHSA-2017:3454 - https://access.redhat.com/errata/RHSA-2017:1550 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2595
CVE ID: CVE-2017-2596 State: PUBLISHED Published: 2017-02-06T06:04:00 Last Updated: 2024-08-05T14:02:06.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS memory consumption) by leveraging the mishandling of page references. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1417812 - http://www.openwall.com/lists/oss-security/2017/01/31/4 - http://www.securityfocus.com/bid/95878 - https://access.redhat.com/errata/RHS
wall.com/lists/oss-security/2017/01/31/4 - http://www.securityfocus.com/bid/95878 - https://access.redhat.com/errata/RHSA-2017:2077 - https://access.redhat.com/errata/RHSA-2017:1842 - http://www.debian.org/security/2017/dsa-3791
CVE ID: CVE-2017-2597 State: REJECTED Published: 2022-08-08T18:52:28 Last Updated: 2022-08-08T18:52:28 Description: No description available.
CVE ID: CVE-2017-2598 State: PUBLISHED Published: 2018-05-23T13:00:00 Last Updated: 2024-08-05T14:02:06.933Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-325 Description: Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://github.com/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2
om/jenkinsci/jenkins/commit/e6aa166246d1734f4798a9e31f78842f4c85c28b - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2598 - http://www.securityfocus.com/bid/95948
CVE ID: CVE-2017-2599 State: PUBLISHED Published: 2018-04-11T16:00:00 Last Updated: 2024-08-05T14:02:06.971Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-863 Description: Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95949 - https://jenkins.io/security/advisory/2017-02-01/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599 -
/95949 - https://jenkins.io/security/advisory/2017-02-01/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2599 - https://github.com/jenkinsci/jenkins/commit/4ed5c850b6855ab064a66d02fb338f366853ce89
CVE ID: CVE-2017-2600 State: PUBLISHED Published: 2018-05-15T20:00:00 Last Updated: 2024-08-05T14:02:06.499Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-325 Description: In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - http://www.securityfocus.com/bid/95954 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2600 - https://github.com/j
ttp://www.securityfocus.com/bid/95954 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2600 - https://github.com/jenkinsci/jenkins/commit/0f92cd08a19207de2cceb6a2f4e3e9f92fdc0899
CVE ID: CVE-2017-2601 State: PUBLISHED Published: 2018-05-10T00:00:00 Last Updated: 2024-08-05T14:02:06.982Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: unspecified Products: jenkins Problem Types: CWE-79 Description: Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2601 - http://www.secu
//jenkins.io/security/advisory/2017-02-01/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2601 - http://www.securityfocus.com/bid/95960 - https://github.com/jenkinsci/jenkins/commit/fd2e081b947124c90bcd97bfc55e1a7f2ef41a74 - http://www.openwall.com/lists/oss-security/2022/04/12/5 - http://www.openwall.com/lists/oss-security/2022/05/17/8 - http://www.openwall.com/lists/oss-security/2022/06/22/3 - http://www.openwall.com/lists/oss-security/2022/06/30/3 - http://www.openwall.com/lists/oss-security/2022/10/19/3
CVE ID: CVE-2017-2602 State: PUBLISHED Published: 2018-05-15T21:00:00 Last Updated: 2024-08-05T14:02:06.917Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-184 Description: jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2602 - https://jenkins.io/security/advisory/2017-02-01/ - https://github.com/jenkinsci/jenki
om/show_bug.cgi?id=CVE-2017-2602 - https://jenkins.io/security/advisory/2017-02-01/ - https://github.com/jenkinsci/jenkins/commit/414ff7e30aba66bed18c4ee8a8660fb36fc8c655 - http://www.securityfocus.com/bid/95952
CVE ID: CVE-2017-2603 State: PUBLISHED Published: 2018-05-15T21:00:00 Last Updated: 2024-08-05T14:02:06.483Z Severity: LOW (CVSS 2.6 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-325 Description: Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2603 - https://github.com/jenkinsci/jenkins/commit/3cd946cbef82c6da5ccccf3890d0ae4e091c4265 - http://w
g.cgi?id=CVE-2017-2603 - https://github.com/jenkinsci/jenkins/commit/3cd946cbef82c6da5ccccf3890d0ae4e091c4265 - http://www.securityfocus.com/bid/95955
CVE ID: CVE-2017-2604 State: PUBLISHED Published: 2018-05-15T21:00:00 Last Updated: 2024-08-05T14:02:06.918Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-358 Description: In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - http://www.securityfocus.com/bid/95959 - https://github.com/jenkinsci/jenkins/commit/6efcf6c2ac39bc5c59ac7251822be8ddf67ceaf8 - https://bugzill
s.com/bid/95959 - https://github.com/jenkinsci/jenkins/commit/6efcf6c2ac39bc5c59ac7251822be8ddf67ceaf8 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2604
CVE ID: CVE-2017-2605 State: REJECTED Published: 2017-07-24T17:00:00 Last Updated: 2017-07-24T16:57:01 Description: No description available.