Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
//www.openwall.com/lists/oss-security/2019/07/25/7 - http://www.openwall.com/lists/oss-security/2019/07/26/4 - http://www.openwall.com/lists/oss-security/2021/05/04/7 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149 - https://www.exim.org/static/doc/security/CVE-2019-10149.txt - http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html - http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html - http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html
CVE ID: CVE-2019-10150 State: PUBLISHED Published: 2019-06-12T13:42:36 Last Updated: 2024-08-04T22:10:10.023Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: redhat Products: atomic-openshift Problem Types: CWE-287 Description: It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output. Additional Analyst Notes: - CVE Program Container: References: - https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh
: References: - https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10150 - https://access.redhat.com/errata/RHSA-2019:2989 - https://access.redhat.com/errata/RHSA-2019:3007 - https://access.redhat.com/errata/RHSA-2019:3143 - https://access.redhat.com/errata/RHSA-2019:3811
CVE ID: CVE-2019-10151 State: REJECTED Published: 2021-03-19T19:19:36 Last Updated: 2021-03-19T19:19:36 Description: No description available.
CVE ID: CVE-2019-10152 State: PUBLISHED Published: 2019-07-30T22:07:23 Last Updated: 2024-08-04T22:10:09.977Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Podman Products: podman Problem Types: CWE-59, CWE-22 Description: A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
itional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152 - https://github.com/containers/libpod/issues/3211 - https://github.com/containers/libpod/pull/3214 - https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
CVE ID: CVE-2019-10153 State: PUBLISHED Published: 2019-07-30T22:10:35 Last Updated: 2024-08-04T22:10:10.012Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: ClusterLabs Products: fence-agents Problem Types: CWE-172 Description: A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?i
is a member. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10153 - https://github.com/ClusterLabs/fence-agents/pull/255 - https://github.com/ClusterLabs/fence-agents/pull/272 - https://access.redhat.com/errata/RHSA-2019:2037
CVE ID: CVE-2019-10154 State: PUBLISHED Published: 2019-06-26T18:19:47 Last Updated: 2024-08-04T22:10:09.986Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Moodle Products: moodle Problem Types: CWE-285 Description: A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10154 - https://moodle.org/mod/forum/discuss.php?d=386521
CVE ID: CVE-2019-10155 State: PUBLISHED Published: 2019-06-12T13:51:01 Last Updated: 2024-08-04T22:10:09.974Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: the libreswan Project Products: libreswan Problem Types: CWE-354 Description: The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29. Additional Analyst Notes: - CVE Program Container: References: - https://libreswan.org/security/CVE-2019-10155/ - https
Additional Analyst Notes: - CVE Program Container: References: - https://libreswan.org/security/CVE-2019-10155/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10155 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW/ - https://access.redhat.com/errata/RHSA-2019:3391
CVE ID: CVE-2019-10156 State: PUBLISHED Published: 2019-07-30T22:12:30 Last Updated: 2024-08-04T22:10:09.972Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: ansible Problem Types: CWE-200 Description: A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156 - https://githu
Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156 - https://github.com/ansible/ansible/pull/57188 - https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html - https://access.redhat.com/errata/RHSA-2019:3744 - https://access.redhat.com/errata/RHSA-2019:3789 - https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2019-10157 State: PUBLISHED Published: 2019-06-12T13:48:42 Last Updated: 2024-08-04T22:10:10.057Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: keycloak Problem Types: CWE-345 Description: It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157 - http://www.s
Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157 - http://www.securityfocus.com/bid/108734
CVE ID: CVE-2019-10158 State: PUBLISHED Published: 2020-01-02T14:28:44.000Z Last Updated: 2025-02-13T16:27:20.229Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: infinispan Problem Types: CWE-384 Description: A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158 - https://github.com/infinispan/infinispan/pull/6960 - https://github.com/infinispan/infinispan/pull/7025 - https:/
0158 - https://github.com/infinispan/infinispan/pull/6960 - https://github.com/infinispan/infinispan/pull/7025 - https://security.netapp.com/advisory/ntap-20231227-0009/
CVE ID: CVE-2019-10159 State: PUBLISHED Published: 2019-06-14T13:53:19 Last Updated: 2024-08-04T22:10:09.973Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: cfme Problem Types: CWE-285 Description: cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159 - https://access.redhat.com/errata/RHSA-2019:2466
CVE ID: CVE-2019-10160 State: PUBLISHED Published: 2019-06-07T17:50:33 Last Updated: 2024-08-04T22:10:10.028Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Python Products: python Problem Types: CWE-172 Description: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attac
er-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application. Additional Analyst Notes: - CVE Program Container: References: - https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160 - https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e -
com/show_bug.cgi?id=CVE-2019-10160 - https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e - https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de - https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09 - https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468 - https://security.netapp.com/advisory/ntap-20190617-0003/ - https://access.redhat.com/errata/RHSA-2019:1587 - https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html - https://access.redhat.com/errata/RHSA-2019:1700 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44
ata/RHSA-2019:1700 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ - https://access.redhat.com/errata/RHSA-2019:2437 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html - https://usn.ubuntu.c
rrata/RHSA-2019:2437 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html - https://usn.ubuntu.com/4127-2/ - https://usn.ubuntu.com/4127-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ - ht
edoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.debian.org/debian-lts-
c8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html
CVE ID: CVE-2019-10161 State: PUBLISHED Published: 2019-07-30T22:14:10 Last Updated: 2024-08-04T22:10:10.036Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Libvirt Products: libvirt Problem Types: CWE-284 Description: It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. Additional Analyst Notes: -
f arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161 - https://access.redhat.com/libvirt-privesc-vulnerabilities - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580 - https://usn.ubuntu.com/4047-2/ - https://security.gentoo.org/glsa/202003-18
CVE ID: CVE-2019-10162 State: PUBLISHED Published: 2019-07-30T22:15:35 Last Updated: 2024-08-04T22:10:10.028Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: PowerDNS Products: pdns Problem Types: CWE-400 Description: A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while looking up the NS/A/AAAA records it is about to use for an outgoing notify. Additional Analyst Notes: - CVE Program Con
looking up the NS/A/AAAA records it is about to use for an outgoing notify. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10162 - https://blog.powerdns.com/2019/06/21/powerdns-authoritative-server-4-0-8-and-4-1-10-released/ - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-04.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00054.html
CVE ID: CVE-2019-10163 State: PUBLISHED Published: 2019-07-30T22:16:59 Last Updated: 2024-08-04T22:10:10.003Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: PowerDNS Products: pdns Problem Types: CWE-770 Description: A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU load or even prevent any further updates to any slave zone by sending a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce
e. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00054.html - https://blog.powerdns.com/2019/06/21/powerdns-authoritative-server-4-0-8-and-4-1-10-released/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10163 - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-05.html
CVE ID: CVE-2019-10164 State: PUBLISHED Published: 2019-06-26T15:29:13 Last Updated: 2024-08-04T22:10:10.043Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PostgreSQL Products: PostgreSQL Problem Types: CWE-121 Description: PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-20
unt. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10164 - https://www.postgresql.org/about/news/1949/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAGE6H4FWLKFLHLWVYNPYGQRPIXTUWGB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TTKEHXGDXYYD6WYDIIQJP4GDQJSENDJK/ - https://security.gentoo.org/glsa/202003-03
CVE ID: CVE-2019-10165 State: PUBLISHED Published: 2019-07-30T22:18:05 Last Updated: 2024-08-04T22:10:10.026Z Severity: LOW (CVSS 2.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: openshift Problem Types: CWE-532 Description: OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could recover OAuth tokens from these audit logs and use them to access other resources. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10165 - https://github.com/openshift/cluster-kube
er: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10165 - https://github.com/openshift/cluster-kube-apiserver-operator/pull/499/ - https://github.com/openshift/cluster-openshift-apiserver-operator/pull/205
CVE ID: CVE-2019-10166 State: PUBLISHED Published: 2019-08-02T12:02:59 Last Updated: 2024-08-04T22:10:09.965Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: libvirt Products: libvirt Problem Types: CWE-284 Description: It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. Additional Analyst Notes: - CVE Prog
such that libvirtd would execute an arbitrary program when the domain was resumed. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/libvirt-privesc-vulnerabilities - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10166 - https://security.gentoo.org/glsa/202003-18
CVE ID: CVE-2019-10167 State: PUBLISHED Published: 2019-08-02T12:05:52 Last Updated: 2024-08-04T22:10:09.976Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: libvirt Products: libvirt Problem Types: CWE-284, CWE-250 Description: The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Additional Analy
trary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/libvirt-privesc-vulnerabilities - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167 - https://security.gentoo.org/glsa/202003-18
CVE ID: CVE-2019-10168 State: PUBLISHED Published: 2019-08-02T12:08:14 Last Updated: 2024-08-04T22:10:10.037Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: libvirt Products: libvirt Problem Types: CWE-284, CWE-250 Description: The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own pri
nts could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/libvirt-privesc-vulnerabilities - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10168 - https://security.gentoo.org/glsa/202003-18
CVE ID: CVE-2019-10169 State: PUBLISHED Published: 2020-05-08T13:47:00 Last Updated: 2024-08-04T22:10:10.032Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: keycloak Problem Types: CWE-267 Description: A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10169
CVE ID: CVE-2019-10170 State: PUBLISHED Published: 2020-05-08T13:47:37 Last Updated: 2024-08-04T22:10:09.965Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: keycloak Problem Types: CWE-267 Description: A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-
user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10170