Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-3087 State: PUBLISHED Published: 2016-06-07T18:00:00 Last Updated: 2024-08-05T23:40:15.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036017 - https://www.exploit-db.com/exploits/39919/ - http://struts.apache.org/docs/s2-033.html - http://www-01.ibm.com/support/docview.wss?uid=swg21987854 - http://www.securityfocus.com/b
apache.org/docs/s2-033.html - http://www-01.ibm.com/support/docview.wss?uid=swg21987854 - http://www.securityfocus.com/bid/90960
CVE ID: CVE-2016-3088 State: PUBLISHED Published: 2016-06-01T20:00:00.000Z Last Updated: 2025-10-21T23:55:51.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.zerodayinitiative.com/advisories/ZDI-16-356 - https://www.exploit-db.com/exploits/42283/ - http://www.zerodayinitiative.com/advisories/ZDI-16-357 - http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt - http://rhn.re
visories/ZDI-16-357 - http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt - http://rhn.redhat.com/errata/RHSA-2016-2036.html - http://www.securitytracker.com/id/1035951 - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E - https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
CVE ID: CVE-2016-3089 State: PUBLISHED Published: 2016-08-19T21:00:00 Last Updated: 2024-08-05T23:40:15.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/138313/Apache-OpenMeetings-3.1.0-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/92442 - http://openmeetings.apache.org/security.html - http://www.securityfocus.com/archive/1/539192/100/0/threaded - https://www.apache.org/dist/openmeetin
rg/security.html - http://www.securityfocus.com/archive/1/539192/100/0/threaded - https://www.apache.org/dist/openmeetings/3.1.2/CHANGELOG
CVE ID: CVE-2016-3090 State: PUBLISHED Published: 2017-10-30T14:00:00 Last Updated: 2024-08-05T23:40:15.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/85131 - https://struts.apache.org/docs/s2-027.html - https://www.securitytracker.com/id/1035267 - https://security.netapp.com/advisory/ntap-20180629-0005/
CVE ID: CVE-2016-3091 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-05T23:40:15.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/05/17/8
CVE ID: CVE-2016-3092 State: PUBLISHED Published: 2016-07-04T22:00:00 Last Updated: 2024-08-05T23:40:15.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121 - https://security.netapp.com/advisory/ntap-20190212-0001/ - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?d
//security.netapp.com/advisory/ntap-20190212-0001/ - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 - http://svn.apache.org/viewvc?view=revision&revision=1743480 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://security.gentoo.org/glsa/201705-09 - http://svn.apache.org/viewvc?view=revision&revision=1743738 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840 - http://tomcat.apache.org/security-9.html - http://www.ubuntu.com/usn/USN-3024-1 - http://rhn.redhat.com/errata/RHSA-2016-2069.html - http://www.securitytracker.com/id/1037029 - http://rhn.redhat.com/errata/RHSA-2016-20
t.com/errata/RHSA-2016-2069.html - http://www.securitytracker.com/id/1037029 - http://rhn.redhat.com/errata/RHSA-2016-2068.html - http://tomcat.apache.org/security-7.html - http://www.securitytracker.com/id/1036900 - http://www.securityfocus.com/bid/91453 - http://tomcat.apache.org/security-8.html - http://rhn.redhat.com/errata/RHSA-2016-2072.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://svn.apache.org/viewvc?view=revision&revision=1743722 - http://www.debian.org/security/2016/dsa-3611 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c
www.debian.org/security/2016/dsa-3611 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371 - http://rhn.redhat.com/errata/RHSA-2016-2807.html - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html - http://jvn.jp/en/jp/JVN89379547/index.html - http://www.securitytracker.com/id/1036427 - http://rhn.redhat.com/errata/RHSA-2016-2070.html - http://rhn.redhat.com/errata/RHSA-2017-0457.html - http://rhn.redhat.com/errata/RHSA-2016-2808.html - http://www.securitytracker.com/id/1039606 - http://svn.apache.org/viewvc?view=revision&revision=1743742 - http://rhn.redhat.com/err
securitytracker.com/id/1039606 - http://svn.apache.org/viewvc?view=revision&revision=1743742 - http://rhn.redhat.com/errata/RHSA-2016-2599.html - http://www.debian.org/security/2016/dsa-3609 - https://access.redhat.com/errata/RHSA-2017:0455 - http://www.debian.org/security/2016/dsa-3614 - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E - https://access.redhat.com/errata/RHSA-2017:0456 - https://bugzilla.redhat.com/show_bug.cgi?id=1349468 - http://rhn.redhat.com/errata/RHSA-2016-2071.html - http://www.ubuntu.com/usn/USN
la.redhat.com/show_bug.cgi?id=1349468 - http://rhn.redhat.com/errata/RHSA-2016-2071.html - http://www.ubuntu.com/usn/USN-3027-1 - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://security.gentoo.org/glsa/202107-39
CVE ID: CVE-2016-3093 State: PUBLISHED Published: 2016-06-07T18:00:00 Last Updated: 2024-08-05T23:40:15.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://struts.apache.org/docs/s2-034.html - http://www.securityfocus.com/bid/90961 - http://www.securitytracker.com/id/1036018 - http://www-01.ibm.com/support/docview.wss?uid=swg21987854 - https://lists.apache.org/thread.html/940b4c3fef0024
036018 - http://www-01.ibm.com/support/docview.wss?uid=swg21987854 - https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E
CVE ID: CVE-2016-3094 State: PUBLISHED Published: 2016-06-01T20:00:00 Last Updated: 2024-08-05T23:40:15.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/QPID-7271 - https://svn.apache.org/viewvc?view=revision&revision=1744403 - http://www.securitytracker.com/id/1035982 - http://packetstormsecurity.com/files/137215/A
ew=revision&revision=1744403 - http://www.securitytracker.com/id/1035982 - http://packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html - http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html - http://www.securityfocus.com/archive/1/538507/100/0/threaded - http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3E
CVE ID: CVE-2016-3095 State: PUBLISHED Published: 2017-06-08T19:00:00 Last Updated: 2024-08-05T23:40:15.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pulp/pulp/pull/2503/commits/9f969b94c4b4f310865455d36db207de6cffebca - https://bugzilla.redhat.com/show_bug.cgi?id=1322706 - http://www.openwall.com/lists/oss-security/2016/04/06/3 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182006.html - http://www.openwall.com/lists/oss-security/2016/04/18/11
CVE ID: CVE-2016-3096 State: PUBLISHED Published: 2016-06-03T14:00:00 Last Updated: 2024-08-05T23:47:56.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1322925 - http://lists.fedoraproject.org/piper
gram Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1322925 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183274.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183252.html - https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184175.html - https://github.com/ansible/ansible/blob/v2.0.2.0-1/CHANGELOG.md#202-over-the-hills-and-far-away - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183132.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183103.h
/package-announce/2016-April/183132.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183103.html - https://groups.google.com/forum/#%21topic/ansible-announce/tqiZbcWxYig - https://security.gentoo.org/glsa/201607-14 - https://groups.google.com/forum/#%21topic/ansible-announce/E80HLZilTU0 - https://github.com/ansible/ansible-modules-extras/pull/1941 - https://github.com/ansible/ansible/blob/v1.9.6-1/CHANGELOG.md#196-dancing-in-the-street---tbd
CVE ID: CVE-2016-3097 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-05T23:47:56.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via a group name, related to viewing snapshot data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1322747 - http://rhn.redhat.com/errata/RHSA-2016-1484.html
CVE ID: CVE-2016-3098 State: PUBLISHED Published: 2022-08-05T15:22:14 Last Updated: 2024-08-05T23:47:56.988Z Vendors: n/a Products: administrate Problem Types: CWE-352 Description: Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2016/q2/0
CVE ID: CVE-2016-3099 State: PUBLISHED Published: 2017-06-08T19:00:00 Last Updated: 2024-08-05T23:47:56.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183102.html - https://bugzilla.redhat.com/show_bug.cgi?id=1319052 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183129.htm
lla.redhat.com/show_bug.cgi?id=1319052 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183129.html - http://rhn.redhat.com/errata/RHSA-2016-2602.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184345.html
CVE ID: CVE-2016-3100 State: PUBLISHED Published: 2016-07-13T15:00:00 Last Updated: 2024-08-05T23:47:56.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file. Additional Analyst Notes: - CVE Program Container: References: - https://quickgit.kde.org/?p=kinit.git&a=commitdiff&h=dece8fd89979cd1a86c03bcaceef6e9221e8d8cd - https://quickgit.kde.org/?p=kinit.git&a=commitdiff&h=72f3702dbe6cf15c06dc13da2c99c864e9022a58 - http://www.securityfocus.com/bid/91769
it.kde.org/?p=kinit.git&a=commitdiff&h=72f3702dbe6cf15c06dc13da2c99c864e9022a58 - http://www.securityfocus.com/bid/91769 - http://lists.opensuse.org/opensuse-updates/2016-07/msg00001.html - https://bugs.kde.org/show_bug.cgi?id=358593 - http://www.kde.com/announcements/kde-frameworks-5.23.0.php - https://www.kde.org/info/security/advisory-20160621-1.txt - https://bugs.kde.org/show_bug.cgi?id=363140
CVE ID: CVE-2016-3101 State: PUBLISHED Published: 2017-02-09T15:00:00 Last Updated: 2024-08-05T23:47:56.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11
CVE ID: CVE-2016-3102 State: PUBLISHED Published: 2017-02-09T15:00:00 Last Updated: 2024-08-05T23:47:56.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11
CVE ID: CVE-2016-3103 State: REJECTED Published: 2021-12-28T18:41:10 Last Updated: 2021-12-28T18:41:10 Description: No description available.
CVE ID: CVE-2016-3104 State: PUBLISHED Published: 2017-04-14T18:00:00 Last Updated: 2024-08-05T23:47:56.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1324496 - http://www.securityfocus.com/bid/94929 - https://jira.mongodb.org/browse/SERVER-24378
CVE ID: CVE-2016-3105 State: PUBLISHED Published: 2016-05-09T20:00:00 Last Updated: 2024-08-05T23:47:56.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201612-19 - http://www.securityfocus.com/bid/90536 - https://selenic.com/hg/rev/a56296f55a5e - http://lists.opensuse.org/opensuse-updates/2016-05/msg00082.html - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255 - https://www.mercurial-
//www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.533255 - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29 - http://www.debian.org/security/2016/dsa-3570
CVE ID: CVE-2016-3106 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-05T23:47:57.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner. Additional Analyst Notes: - CVE Program Container: References: - https://pulp.plan.io/issues/1827 - https://bugzilla.redhat.com/show_bug.cgi?id=1324926 - http://www.openwall.com/lists/oss-security/2016/05/20/1 - http://www.openwall.com/lists/oss-security/2016/04/18/11
CVE ID: CVE-2016-3107 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-05T23:47:56.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1325930 - https://pulp.plan.io/issues/1833 - https://bugzilla.redhat.com/attachment.cgi?id=1146471 - https://access.redhat.com/errata/RHBA-2016:1501 - http://www.openwall.com/lists/oss-security/2016/05/20/1
CVE ID: CVE-2016-3108 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-05T23:47:56.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/attachment.cgi?id=1146475 - https://github.com/pulp/pulp/pull/2528 - https://access.redhat.com/errata/RHBA-2016:1501 - https://bugzilla.redhat.com/show_bug.cgi?id=1325934 - https://pulp.plan.io/issues/1830 - http://www.openwall.com/lists/oss-security/2016/05/20/1
CVE ID: CVE-2016-3109 State: PUBLISHED Published: 2017-04-21T20:00:00 Last Updated: 2024-08-05T23:47:56.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/shopware/commit/d73e9031a5b2ab6e918eb86d1e2b2e873cd3558d - http://packetstormsecurity.com/files/136781/Shopware-Remote-Code-Execution.html - http://www.securityfocus.com/bid/97979 - http://www.securityfocus.com/archive/1/538173/100/0/threaded
CVE ID: CVE-2016-3110 State: PUBLISHED Published: 2016-09-26T14:00:00 Last Updated: 2024-08-05T23:47:57.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-2056.html - https://bugzilla.redhat.com/show_bug.cgi?id=1326320 - http://rhn.redhat.com/errata/RHSA-2016-1648.html - http://www.securityfocus.com/bid/92584 - http://rhn.redhat.com/errata/RHSA-2016-2055
at.com/errata/RHSA-2016-1648.html - http://www.securityfocus.com/bid/92584 - http://rhn.redhat.com/errata/RHSA-2016-2055.html - http://rhn.redhat.com/errata/RHSA-2016-1649.html - http://rhn.redhat.com/errata/RHSA-2016-1650.html - http://rhn.redhat.com/errata/RHSA-2016-2054.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CX5QNNIVAUB2VVDV6TR3YMFTL6VRKOBO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JMA2YLPK6SEUVF5Q3QEANHYEPRZA2RI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE5YZTBZRXCMQFT5LDLZG2HAYBKMYQLL/
CVE ID: CVE-2016-3111 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-05T23:47:57.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running. Additional Analyst Notes: - CVE Program Container: References: - http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620 - http://pkgs.fedoraproject.org/cgit/rpm
erences: - http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n620 - http://pkgs.fedoraproject.org/cgit/rpms/pulp.git/tree/pulp.spec#n317 - https://bugzilla.redhat.com/show_bug.cgi?id=1326251 - https://bugzilla.redhat.com/attachment.cgi?id=1146522 - https://access.redhat.com/errata/RHBA-2016:1501 - https://pulp.plan.io/issues/1837 - https://github.com/pulp/pulp/blob/master/pulp.spec#L894-L903 - http://www.openwall.com/lists/oss-security/2016/05/20/1 - https://github.com/pulp/pulp/blob/master/pulp.spec#L473-L486
CVE ID: CVE-2016-3112 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-05T23:47:57.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticating as a consumer user. Additional Analyst Notes: - CVE Program Container: References: - https://pulp.plan.io/issues/1834 - https://bugzilla.redhat.com/attachment.cgi?id=1146538 - https://bugzilla.redhat.com/show_bug.cgi?id=1326242 -