Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-3806 State: PUBLISHED Published: 2019-01-29T17:00:00 Last Updated: 2024-08-04T19:19:18.319Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H) Vendors: Power DNS Products: pdns-recursor Problem Types: CWE-358 Description: An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua. Additional Analyst Notes: - CVE Program Container: References: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html - https://bugzilla.redhat.com/show_bug.c
//docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-01.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3806
CVE ID: CVE-2019-3807 State: PUBLISHED Published: 2019-01-29T17:00:00 Last Updated: 2024-08-04T19:19:18.394Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Power DNS Products: pdns-recursor Problem Types: CWE-345 Description: An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated, allowing an attacker to bypass DNSSEC validation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html - https://bugzilla.redhat.com
s: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2019-02.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3807
CVE ID: CVE-2019-3808 State: PUBLISHED Published: 2019-03-25T17:28:32 Last Updated: 2024-08-04T19:19:18.492Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-79 Description: A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default. Additional Analyst Notes: - CVE Program Container: References: - https://bu
ssigned to teachers and managers by default. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3808 - https://moodle.org/mod/forum/discuss.php?d=381228#p1536765 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395
CVE ID: CVE-2019-3809 State: PUBLISHED Published: 2019-03-25T17:38:35 Last Updated: 2024-08-04T19:19:18.620Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-352 Description: A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809 - https://moodle.org/mod/fo
E Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809 - https://moodle.org/mod/forum/discuss.php?d=381229#p1536766 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222
CVE ID: CVE-2019-3810 State: PUBLISHED Published: 2019-03-25T00:00:00 Last Updated: 2024-08-04T19:19:18.619Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-79 Description: A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810 - https://
alyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810 - https://moodle.org/mod/forum/discuss.php?d=381230#p1536767 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372 - http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html
CVE ID: CVE-2019-3811 State: PUBLISHED Published: 2019-01-15T15:00:00.000Z Last Updated: 2025-02-13T16:27:24.771Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: The sssd Project Products: sssd Problem Types: CWE-552, CWE-200 Description: A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.
All versions before 2.1 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/01/msg00011.html - http://www.securityfocus.com/bid/106644 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3811 - http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00045.html - https://access.redhat.com/errata/RHSA-2019:2177 - https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html
CVE ID: CVE-2019-3812 State: PUBLISHED Published: 2019-02-19T14:00:00 Last Updated: 2024-08-04T19:19:18.499Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: The QEMU Project Products: qemu Problem Types: CWE-119 Description: QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3812 - http://www.securityfocus.com/b
gram Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3812 - http://www.securityfocus.com/bid/107059 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/ - https://usn.ubuntu.com/3923-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00094.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00040.html - https://www.debian.org/security/2019/dsa-4454 - https://seclists.org/bugtraq/2019/May/76
CVE ID: CVE-2019-3813 State: PUBLISHED Published: 2019-02-04T18:00:00Z Last Updated: 2024-09-16T16:23:33.117Z Vendors: Red Hat, Inc. Products: Spice Problem Types: Denial of Service Description: Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4375 - https://access.redhat.com/errata/RHSA-2019:0231 - http://www.securityfocus.com/bid/106801 - https://access.redhat.com/errata/RHSA-2019:0457 - https://bugzilla.r
19:0231 - http://www.securityfocus.com/bid/106801 - https://access.redhat.com/errata/RHSA-2019:0457 - https://bugzilla.redhat.com/show_bug.cgi?id=1665371 - https://usn.ubuntu.com/3870-1/ - https://access.redhat.com/errata/RHSA-2019:0232 - https://lists.debian.org/debian-lts-announce/2019/01/msg00026.html - https://security.gentoo.org/glsa/202007-30
CVE ID: CVE-2019-3814 State: PUBLISHED Published: 2019-03-27T12:20:45 Last Updated: 2024-08-04T19:19:18.590Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: dovecot Products: dovecot Problem Types: CWE-295 Description: It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users. Additional Analyst Notes: - CVE Program Container: References: - https://www.dovecot.org/list/dovecot/2019-February/114575.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3814 - http://l
ovecot.org/list/dovecot/2019-February/114575.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3814 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00067.html - https://security.gentoo.org/glsa/201904-19 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS/ - https://access.redhat.com/errata/RHSA-2019:3467
CVE ID: CVE-2019-3815 State: PUBLISHED Published: 2019-01-28T15:00:00 Last Updated: 2024-08-04T19:19:18.592Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: The systemd Project Products: systemd Problem Types: CWE-401 Description: A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2. Additional Analyst Notes: - CVE Program
is issue only affects versions shipped with Red Hat Enterprise since v219-62.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00013.html - http://www.securityfocus.com/bid/106632 - https://access.redhat.com/errata/RHSA-2019:0201 - https://access.redhat.com/errata/RHBA-2019:0327 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3815
CVE ID: CVE-2019-3816 State: PUBLISHED Published: 2019-03-14T00:00:00 Last Updated: 2024-08-04T19:19:18.633Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: openwsman Problem Types: CWE-22 Description: Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107368 - http://www.securityfocus.com/bid/107409
- CVE Program Container: References: - http://www.securityfocus.com/bid/107368 - http://www.securityfocus.com/bid/107409 - https://access.redhat.com/errata/RHSA-2019:0638 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html - http://lists.opensuse.org/opensuse-security-announc
ists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html - https://access.redhat.com/errata/RHSA-2019:0972 - http://bugzilla.suse.com/show_bug.cgi?id=1122623 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3816
CVE ID: CVE-2019-3817 State: PUBLISHED Published: 2019-03-27T12:25:40 Last Updated: 2024-08-04T19:19:18.587Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: libcomps Products: libcomps Problem Types: CWE-416 Description: A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817 - https://github.com/rpm-software-management/libcomps/issues/41 - https
ugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817 - https://github.com/rpm-software-management/libcomps/issues/41 - https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046 - https://access.redhat.com/errata/RHSA-2019:3583 - https://access.redhat.com/errata/RHSA-2019:3898
CVE ID: CVE-2019-3818 State: PUBLISHED Published: 2019-02-05T17:00:00 Last Updated: 2024-08-04T19:19:18.599Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: kube-rbac-proxy Problem Types: CWE-327 Description: The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2019-3818 - http://www.s
nalyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2019-3818 - http://www.securityfocus.com/bid/106744 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3818 - https://access.redhat.com/errata/RHBA-2019:0327
CVE ID: CVE-2019-3819 State: PUBLISHED Published: 2019-01-25T18:00:00 Last Updated: 2024-08-04T19:19:18.612Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: The Linux Foundation Products: kernel: Problem Types: CWE-835 Description: A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ("root") can cause a system lock up and a denial of service. Versions from v4.18 and newer are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106730 - https
erable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106730 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3819 - https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html - https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html - https://usn.ubuntu.com/3932-1/ - https://usn.ubuntu.com/3932-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00052.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4118-1/
CVE ID: CVE-2019-3820 State: PUBLISHED Published: 2019-02-06T20:00:00 Last Updated: 2024-08-04T19:19:18.588Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: The Gnome Project Products: gnome-shell Problem Types: CWE-285 Description: It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820 - https://gitlab.gnome.org/GNOME/gnome-shell/issues/851 -
: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820 - https://gitlab.gnome.org/GNOME/gnome-shell/issues/851 - https://usn.ubuntu.com/3966-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00049.html
CVE ID: CVE-2019-3821 State: PUBLISHED Published: 2019-03-27T12:22:00 Last Updated: 2024-08-04T19:19:18.564Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: ceph Problem Types: CWE-772 Description: A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4035-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821 - https://
ner: References: - https://usn.ubuntu.com/4035-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3821 - https://github.com/ceph/civetweb/pull/33
CVE ID: CVE-2019-3822 State: PUBLISHED Published: 2019-02-06T20:00:00 Last Updated: 2024-08-04T19:19:18.599Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: The curl Project Products: curl Problem Types: CWE-121 Description: libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the ov
local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 - https://www.debian.org/security/2019/dsa-4386 - h
01903-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 - https://www.debian.org/security/2019/dsa-4386 - https://curl.haxx.se/docs/CVE-2019-3822.html - https://security.netapp.com/advisory/ntap-20190315-0001/ - https://usn.ubuntu.com/3882-1/ - http://www.securityfocus.com/bid/106950 - https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E - https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://security.netapp.com/advisory/ntap-201907
/www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://security.netapp.com/advisory/ntap-20190719-0004/ - https://support.f5.com/csp/article/K84141449 - https://support.f5.com/csp/article/K84141449?utm_source=f5support&amp%3Butm_medium=RSS - https://access.redhat.com/errata/RHSA-2019:3701
CVE ID: CVE-2019-3823 State: PUBLISHED Published: 2019-02-06T20:00:00 Last Updated: 2024-08-04T19:19:18.612Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: The curl Project Products: curl Problem Types: CWE-125 Description: libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Additional Analyst Notes: - CVE Program Contain
allocated buffer. The read contents will not be returned to the caller. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-03 - https://www.debian.org/security/2019/dsa-4386 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3823 - https://curl.haxx.se/docs/CVE-2019-3823.html - https://security.netapp.com/advisory/ntap-20190315-0001/ - https://usn.ubuntu.com/3882-1/ - http://www.securityfocus.com/bid/106950 - https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.c
nfra.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2019:3701 - https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf
CVE ID: CVE-2019-3824 State: PUBLISHED Published: 2019-03-06T15:00:00 Last Updated: 2024-08-04T19:19:18.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00000.html - https://www.debian.org/security/2019/dsa-4397 - https://bugzilla.samba.org/show_bug.cgi?id=13773 - https://usn.ubuntu.com/3895-1/ - http://
org/security/2019/dsa-4397 - https://bugzilla.samba.org/show_bug.cgi?id=13773 - https://usn.ubuntu.com/3895-1/ - http://www.securityfocus.com/bid/107347 - https://security.netapp.com/advisory/ntap-20190226-0001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3824 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00035.html
CVE ID: CVE-2019-3825 State: PUBLISHED Published: 2019-02-06T20:00:00 Last Updated: 2024-08-04T19:19:18.680Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The Gnome Projectr Products: gdm Problem Types: CWE-287 Description: A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3892-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825
CVE ID: CVE-2019-3826 State: PUBLISHED Published: 2019-03-26T17:48:31 Last Updated: 2024-08-04T19:19:18.663Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: prometheus Problem Types: CWE-79 Description: A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826 - https://github.com/prometheus/pro