Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ted by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721095943.GA24320%40minotaur.apache.org%3E - http://www.securityfocus.com/bid/104936 - https://access.redhat.com/errata/RHSA-2018:2469 - https://lists.debian.org/debian-lts-announce/2018/08/msg00023.html - https://access.redhat.com/errata/RHSA-2018:2470 - http://www.securitytracker.com/id/1041507 - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomca
he.org%3E - https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2018-8020 State: PUBLISHED Published: 2018-07-31T13:00:00Z Last Updated: 2024-09-17T01:20:59.717Z Vendors: Apache Software Foundation Products: Apache Tomcat Native Problem Types: Security Constraint Bypass Description: Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability. Additional Analyst Notes: - CVE Progra
e mutual TLS. Users not using OCSP checks are not affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180721101944.GA45239%40minotaur.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:2469 - http://www.securityfocus.com/bid/104934 - https://lists.debian.org/debian-lts-announce/2018/08/msg00023.html - https://access.redhat.com/errata/RHSA-2018:2470 - http://www.securitytracker.com/id/1041507 - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/f8e0814e11c7f
29a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r831e0548fad736a98140d0b3b7dc575af0c50faea0b266434ba813cc%40%3Cdev.rocketmq.apache.org%3E - https://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833%40%3Cdev.rocketmq.apache.o
ttps://lists.apache.org/thread.html/rcddf723a4b4117f8ed6042e9ac25e8c5110a617bab77694b61b14833%40%3Cdev.rocketmq.apache.org%3E - https://lists.apache.org/thread.html/rb25b42f666d2cac5e6e6b3f771faf60d1f1aa58073dcdd8db14edf8a%40%3Cdev.rocketmq.apache.org%3E
CVE ID: CVE-2018-8021 State: PUBLISHED Published: 2018-11-07T14:00:00 Last Updated: 2024-08-05T06:46:11.477Z Vendors: unspecified Products: Superset Problem Types: RCE Description: Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45933/ - https://github.com/apache/incubator-superset/pull/4243
CVE ID: CVE-2018-8022 State: PUBLISHED Published: 2018-08-29T13:00:00Z Last Updated: 2024-09-16T21:57:30.534Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: Information Disclosure Description: A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ce404d2fe16cc59085ece5a6236ccd1549def471a2a9508198d966b1%40%3Cusers.trafficserver.apache.org%3E - http://www.securityfocus.com/bid/105183 - https://github.com/apac
9508198d966b1%40%3Cusers.trafficserver.apache.org%3E - http://www.securityfocus.com/bid/105183 - https://github.com/apache/trafficserver/pull/2147
CVE ID: CVE-2018-8023 State: PUBLISHED Published: 2018-09-21T13:00:00Z Last Updated: 2024-09-16T16:58:25.082Z Vendors: Apache Software Foundation Products: Apache Mesos Problem Types: Information Disclosure Description: Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when th
n routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/9b9d3f6bd09f3ebd2284b82077033bdc71da550a1c4c010c2494acc3%40%3Cdev.mesos.apache.org%3E - https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a%40%3Cuser.flink.apache.org%3E
CVE ID: CVE-2018-8024 State: PUBLISHED Published: 2018-07-12T13:00:00Z Last Updated: 2024-09-17T02:10:38.073Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: Cross-Site Scripting (XSS) Flaw Description: In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly o
recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not. Additional Analyst Notes: - CVE Program Container: References: - https://spark.apache.org/security.html#CVE-2018-8024 - https://lists.apache.org/thread.html/5f241d2cda21cbcb3b63e46e474cf5f50cce66927f08399f4fab0aba%40%3Cdev.spark.apache.org%3E
CVE ID: CVE-2018-8025 State: PUBLISHED Published: 2018-06-27T15:00:00Z Last Updated: 2024-09-16T16:12:44.735Z Vendors: Apache Software Foundation Products: Apache HBase Problem Types: User Authentication Description: CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1,
tps://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104554 - https://lists.apache.org/thread.html/a919e38f587c714c386a01d40fc8f45bd4219a65aaf2dc0bb4eccc96%40%3Cdev.hbase.apache.org%3E
CVE ID: CVE-2018-8026 State: PUBLISHED Published: 2018-07-05T14:00:00Z Last Updated: 2024-09-16T22:14:47.305Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: Information Disclosure Description: This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
s XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr's API, allowing to exploit that vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104690 - https://issues.apache.org/jira/browse/SOLR-12450 - https://security.netapp.com/advisory/ntap-20190307-0002/ - https://mail-archives.apache.org/mod_mbox/lucene-solr-user/201807.mbox/%3C0cdc01d413b7%24f97ba580%24ec72f080%24%40apache.org%3E
CVE ID: CVE-2018-8027 State: PUBLISHED Published: 2018-07-31T13:00:00Z Last Updated: 2024-09-16T19:25:52.726Z Vendors: Apache Software Foundation Products: Apache Camel Problem Types: XML External Entity Description: Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104933 - https://lists.apache.org/thread.html/77f596fc63e63c2e9adcff3c34759b32c225cf0b582aedb755adaade%40%3Cdev.camel.apache.org%3E - http://camel.apache.org/security-advisories.data/CVE-2018-8027.txt.asc - https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c
visories.data/CVE-2018-8027.txt.asc - https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E
CVE ID: CVE-2018-8028 State: PUBLISHED Published: 2018-08-23T15:00:00 Last Updated: 2024-08-05T06:46:12.327Z Vendors: Apache Software Foundation Products: Apache Sentry Problem Types: Information Disclosure Description: An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/SENTRY/Vulnerabilities+found+in+Apache+Sentry
CVE ID: CVE-2018-8029 State: PUBLISHED Published: 2019-05-30T15:15:42 Last Updated: 2024-08-05T06:46:12.161Z Vendors: n/a Products: Apache Hadoop Problem Types: Privilege Escalation Description: In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/17084c09e6dedf60efe08028b429c92ffd28aacc28454e4fa924578a%40%3Cgeneral.hadoop.apache.org%3E - https://lists.apache.org/thread.html/a97c53a81e639ca2fc7b8f61a4fcd1842c2a78544041244a7c624727%40%3Cissues.hbase.apache.org%3E - http://www
he.org/thread.html/a97c53a81e639ca2fc7b8f61a4fcd1842c2a78544041244a7c624727%40%3Cissues.hbase.apache.org%3E - http://www.securityfocus.com/bid/108518 - https://lists.apache.org/thread.html/a0164b87660223a2d491f83c88f905fe1a9fa8dc795148d9b0d968c8%40%3Cdev.hbase.apache.org%3E - https://lists.apache.org/thread.html/0b8d58e02dbd0fb8bf7320c514fe58da1d6728bdc150f1ba04e0d9fc%40%3Cissues.hbase.apache.org%3E - https://security.netapp.com/advisory/ntap-20190617-0001/ - https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommit
ache.org%3E - https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2018-8030 State: PUBLISHED Published: 2018-06-19T13:00:00Z Last Updated: 2024-09-16T19:41:52.432Z Vendors: Apache Software Foundation Products: Apache Qpid Broker-J Problem Types: Denial of Service Vulnerability Description: A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041138 - https://lists.apache.org/thread.html/
- CVE Program Container: References: - http://www.securitytracker.com/id/1041138 - https://lists.apache.org/thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876%40%3Cusers.qpid.apache.org%3E
CVE ID: CVE-2018-8031 State: PUBLISHED Published: 2018-07-23T22:00:00Z Last Updated: 2024-09-16T17:58:50.281Z Vendors: Apache Software Foundation Products: Apache TomEE Problem Types: Cross site scripting (XSS) Description: The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upg
TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolve in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/c4b0d83a534d6cdf2de54dbbd00e3538072ac2e360781b784608ed0d%40%3Cdev.tomee.apache.org%3E
CVE ID: CVE-2018-8032 State: PUBLISHED Published: 2018-08-02T13:00:00Z Last Updated: 2024-09-16T16:29:01.816Z Vendors: Apache Software Foundation Products: Apache Axis Problem Types: Cross-site Scripting Description: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E - https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E - https://lists.apache.or
html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E - https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://issues.apache.org/jira/browse/AXIS-2924 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - htt
- https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://lists.debian.org/debian-lts-announce/2021/11/msg00015.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2018-8033 State: PUBLISHED Published: 2018-12-13T14:00:00 Last Updated: 2024-08-05T06:46:11.540Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: Information Disclosure Description: In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host. Additional A
TYPEs pointing to external references that trigger a payload that returns secret information from the host. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/e8fb551e86e901932081f81ee9985bb72052b4d412f23d89b1282777%40%3Cuser.ofbiz.apache.org%3E
CVE ID: CVE-2018-8034 State: PUBLISHED Published: 2018-08-01T18:00:00Z Last Updated: 2024-10-21T16:09:49.791Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Security Constraint Bypass Description: The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://usn.ubuntu.com/3723-1/ - http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E - https:/
il-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:0451 - https://lists.debian.org/debian-lts-announce/2018/07/msg00047.html - https://www.debian.org/security/2018/dsa-4281 - http://www.securitytracker.com/id/1041374 - https://security.netapp.com/advisory/ntap-20180817-0001/ - https://access.redhat.com/errata/RHSA-2019:0131 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://access.redhat.com/errata/RHSA-2019:0130 - https://access.redhat.com/errata/RHSA-2019:0450 - https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html - http://www.securityf
at.com/errata/RHSA-2019:0450 - https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html - http://www.securityfocus.com/bid/104895 - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1
d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - http
sts.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:1160 - https://access.redhat.com/errata/RHSA-2019:1162 - https://access.redhat.com/errata/RHSA-2019:1159 - https://access.redhat.com/errata/RHSA-2019:1161 - https://access.redhat.com/errata/RHSA-2019:1529 - htt
RHSA-2019:1159 - https://access.redhat.com/errata/RHSA-2019:1161 - https://access.redhat.com/errata/RHSA-2019:1529 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:2205 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://access.redhat.com/errata/RHSA-2019:3892 - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c587
f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-8035 State: PUBLISHED Published: 2019-05-01T20:16:55 Last Updated: 2024-08-05T06:46:12.231Z Vendors: Apache Products: Apache UIMA DUCC Problem Types: Information Disclosure Description: This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://uima.apache.org/security_report - http://www.securityfocus.com/bid/108195 - https://lists.apache.org/thread.html/2f49681259b
.apache.org/security_report - http://www.securityfocus.com/bid/108195 - https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E
CVE ID: CVE-2018-8036 State: PUBLISHED Published: 2018-07-03T20:00:00Z Last Updated: 2024-09-16T18:28:45.288Z Vendors: Apache Software Foundation Products: Apache PDFBox Problem Types: DoS (OOM) Vulnerability Description: In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2669 - https://lists.apache.org/thread.html/9f62f742fd4fcd81654a9533b8a71349b064250840592bcd502dcfb6%40%3Cusers.pdfbox.apache.org%3E - https://lists.fedoraproject.org/archives
fcd81654a9533b8a71349b064250840592bcd502dcfb6%40%3Cusers.pdfbox.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPOGHJ5CVMUVCRQU7APBAN5IVZGZFDX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HKVPTJWZGUB4MH4AAOWMRJHRDBYFHGJ/ - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.apache.org%3E