Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pgrade to 7.1.4 or later versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/55d225af92887bfed0194400fd1b718622cca4140fc7318d982e25ca%40%3Cusers.trafficserver.apache.org%3E - https://www.debian.org/security/2018/dsa-4282 - http://www.securityfocus.com/bid/105187 - https://github.com/apache/trafficserver/pull/3106 - https://github.com/apache/trafficserver/pull/3124
CVE ID: CVE-2018-8006 State: PUBLISHED Published: 2018-10-10T14:00:00Z Last Updated: 2024-09-16T18:24:11.216Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Problem Types: Cross-Site Scripting Description: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter. Additional Analyst Notes: - CVE Program Container: References: - http://activemq.apache.org/security-advisories.data/CVE-2018-8006-announcement.txt - http://www.securityfocus.com/bid/105156 - https://lists
he.org/security-advisories.data/CVE-2018-8006-announcement.txt - http://www.securityfocus.com/bid/105156 - https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8167a
acaa11a962e1%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8167ad2d39ac0b410f24382d2%40%3Cgitbox.activemq.apache.org%3E - https://lists.apache.org/thread.html/c0ec53b72b3240b187afb1cf67e4309a9e5f607282010aa196734814%40%3Cgitbox.activemq.apache.org%3E - https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E
CVE ID: CVE-2018-8007 State: PUBLISHED Published: 2018-07-11T13:00:00Z Last Updated: 2024-09-16T17:04:00.488Z Vendors: Apache Software Foundation Products: Apache CouchDB Problem Types: Administrative Privilege Escalation Description: Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectivel
ist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3c1439409216.6221.1531246856676.JavaMail.Joan%40RITA%3e - https://security.gentoo.org/glsa/201812-06 - http://mail-archives.apache.org/mod_mbox/couchdb-announce/201807.mbox/%3C1699016538.6219.1531246785603.JavaMail.Joan%40RITA%3E - http://www.sec
ache.org/mod_mbox/couchdb-announce/201807.mbox/%3C1699016538.6219.1531246785603.JavaMail.Joan%40RITA%3E - http://www.securityfocus.com/bid/104741 - https://www.mdsec.co.uk/2018/08/advisory-cve-2018-8007-apache-couchdb-remote-code-execution/ - https://blog.couchdb.org/2018/07/10/cve-2018-8007/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
CVE ID: CVE-2018-8008 State: PUBLISHED Published: 2018-06-05T19:00:00Z Last Updated: 2024-09-16T16:38:31.346Z Vendors: Apache Software Foundation Products: Apache Storm Problem Types: Arbitrary File Write Description: Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Container: Referen
rectory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/613b2fca8bcd0a3b12c0b763ea8f7cf62e422e9f79fce6cfa5b08a58%40%3Cdev.storm.apache.org%3E - http://www.securityfocus.com/bid/104418
CVE ID: CVE-2018-8009 State: PUBLISHED Published: 2018-11-13T21:00:00 Last Updated: 2024-08-05T06:46:11.567Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: Remote Command Execution Description: Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/research/zip-slip-vulnerability - http://www.securityfocus.com/bid/105927 - https://lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973f7f38d%40%3Cuser.hadoop.apache.org%3E -
//lists.apache.org/thread.html/a1c227745ce30acbcf388c5b0cc8423e8bf495d619cd0fa973f7f38d%40%3Cuser.hadoop.apache.org%3E - https://hadoop.apache.org/cve_list.html#cve-2018-8009-http-cve-mitre-org-cgi-bin-cvename-cgi-name-cve-2018-8009-zip-slip-impact-on-apache-hadoop - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache
https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2018-8010 State: PUBLISHED Published: 2018-05-21T19:00:00Z Last Updated: 2024-09-17T00:31:26.316Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: Information Disclosure Description: This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Users are advised to upgrade to either Solr 6
o read arbitrary local files from the Solr server or the internal network. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr instance directory (using Solr's ResourceLoader); usage of absolute URLs is denied. Keep in mind, that external entities and XInclude are explicitly supported to better structure config files in large installations. Before Solr 6 this was no problem, as config files were not accessible through the APIs. Additional Analyst Notes: - CV
Before Solr 6 this was no problem, as config files were not accessible through the APIs. Additional Analyst Notes: - CVE Program Container: References: - https://mail-archives.apache.org/mod_mbox/www-announce/201805.mbox/%3C08a801d3f0f9%24df46d300%249dd47900%24%40apache.org%3E - http://www.securityfocus.com/bid/104239 - https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
CVE ID: CVE-2018-8011 State: PUBLISHED Published: 2018-07-18T14:00:00Z Last Updated: 2024-09-16T22:30:24.315Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: (undefined) Description: By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041401 - https://security.netapp.com/advisory/ntap-20180926-0007/ - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011 - https://lis
com/advisory/ntap-20180926-0007/ - https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4b
40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9
142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-8012 State: PUBLISHED Published: 2018-05-21T19:00:00Z Last Updated: 2024-09-17T00:01:04.102Z Vendors: Apache Software Foundation Products: Apache ZooKeeper Problem Types: Gain Privilege Description: No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4214 - http://www.securitytracker.com/id/1040948 - http://www.securityfocus.com/bid/104253 - https://lists.a
ty/2018/dsa-4214 - http://www.securitytracker.com/id/1040948 - http://www.securityfocus.com/bid/104253 - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.
d.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r8f0d920805af93033c488af89104e2d682662bacfb8406db865d5e14%40%3Cdev.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/rc5bc4ddb0deabf8cfb69378cecee56fcdc76929bea9e6373cb863870%40%3Cdev.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/r73daf1fc5d85677d9a854707e1908d14e174b7bbb0c603709c0ab33f%40%3Coak-commits.jackrabbit.apache.org%3E - https://lists.apache.org/thread.html/re3a4048e9515d4afea416df907a612ed384a16c57cf99e97ee4a12f2%40%3Cdev.jackrabbit.apache.org%3E
CVE ID: CVE-2018-8013 State: PUBLISHED Published: 2018-05-24T16:00:00Z Last Updated: 2024-09-16T23:16:36.073Z Vendors: Apache Software Foundation Products: Apache Batik Problem Types: Information Disclosure Description: In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104252 - https://lists.debian.org/debian-lts-announce/2018/05/msg00016.html - https://www.de
//www.securityfocus.com/bid/104252 - https://lists.debian.org/debian-lts-announce/2018/05/msg00016.html - https://www.debian.org/security/2018/dsa-4215 - https://usn.ubuntu.com/3661-1/ - https://mail-archives.apache.org/mod_mbox/xmlgraphics-batik-dev/201805.mbox/%3c000701d3f28f%24d01860a0%24704921e0%24%40gmail.com%3e - http://www.securitytracker.com/id/1040995 - https://lists.apache.org/thread.html/r9e90b4d1cf6ea87a79bb506541140dfbf4801f4463a7cee08126ee44%40%3Ccommits.xmlgraphics.apache.org%3E - https://lists.apache.org/thread.html/rc0a31867796043fbe59113fb654fe8b13309fe04f8935acb8d0fab19%40%3Ccommits.xmlgraphics.apache.org%3E - http://www.oracle.com/technetwork/security-advisory/cpujul2018-
8935acb8d0fab19%40%3Ccommits.xmlgraphics.apache.org%3E - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://xmlgraphics.apache.org/security.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.gentoo.org/glsa/202401-11
CVE ID: CVE-2018-8014 State: PUBLISHED Published: 2018-05-16T16:00:00 Last Updated: 2024-08-05T06:46:11.468Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: n/a Description: The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. Additional Analyst Notes: - CVE Program Container: Reference
xpected that most users will not be impacted by this issue. Additional Analyst Notes: - CVE Program Container: References: - http://tomcat.apache.org/security-9.html - https://access.redhat.com/errata/RHSA-2019:0451 - http://tomcat.apache.org/security-7.html - https://access.redhat.com/errata/RHSA-2018:2469 - http://www.securitytracker.com/id/1041888 - https://usn.ubuntu.com/3665-1/ - http://tomcat.apache.org/security-8.html - https://access.redhat.com/errata/RHSA-2018:2470 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://security.netapp.com/advisory/ntap-20181018-0002/ - https://access.redhat.com/errata/RHSA-2019:0450 - https://lists.apache.org/thread.
pp.com/advisory/ntap-20181018-0002/ - https://access.redhat.com/errata/RHSA-2019:0450 - https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E - https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html - http://www.securityfocus.com/bid/104203 - http://www.securitytracker.com/id/1040998 - https://access.redhat.com/errata/RHSA-2018:3768 - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org
d.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cd
cat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:1529 -
2f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:1529 - https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2205 - https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html - https://www.debian.org/security/2019/dsa-4596 - https://seclists.org/bugtraq/2019/Dec/43 - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.a
rg%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-8015 State: PUBLISHED Published: 2018-05-18T17:00:00Z Last Updated: 2024-09-16T18:44:19.917Z Vendors: Apache Software Foundation Products: Apache ORC Problem Types: Denial of Service Description: In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the stack. Additional Analyst Notes: - CVE Program Container: References: - https://orc.apache.org/security/CVE-2018-8015/ - http://www.securityfocus.com/bid/104215
CVE ID: CVE-2018-8016 State: PUBLISHED Published: 2018-06-28T16:00:00Z Last Updated: 2024-09-16T18:34:08.513Z Vendors: Apache Software Foundation Products: Apache Cassandra Problem Types: Configuration Description: The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2
regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066%40%3Cuser.cassandra.apache.org%3E
CVE ID: CVE-2018-8017 State: PUBLISHED Published: 2018-09-19T14:00:00Z Last Updated: 2024-09-17T02:27:20.580Z Vendors: Apache Software Foundation Products: Apache Tika Problem Types: DoS Vulnerability -- Potential Infinite Loop in IptcAnpaParser Description: In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/72df7a3f0dda49a912143a1404b489837a11f374dfd1961061873a91%40%3Cdev.tika.apache.org%3E - http://www.securityfocus.com/bid/105513
CVE ID: CVE-2018-8018 State: PUBLISHED Published: 2018-07-19T18:00:00Z Last Updated: 2024-09-17T04:24:27.033Z Vendors: Apache Software Foundation Products: Apache Ignite Problem Types: Information Disclosure Description: In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint. Additional Analyst Notes: - CVE Program Container: Ref
lized object to GridClientJdkMarshaller deserialization endpoint. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104911 - https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab%40%3Cdev.ignite.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:3768
CVE ID: CVE-2018-8019 State: PUBLISHED Published: 2018-07-31T13:00:00Z Last Updated: 2024-09-16T17:23:05.725Z Vendors: Apache Software Foundation Products: Apache Tomcat Native Problem Types: Security Constraint Bypass Description: When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.