Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l login credentials or bearer tokens. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
CVE ID: CVE-2019-10215 State: PUBLISHED Published: 2019-10-08T18:44:41 Last Updated: 2024-08-04T22:17:18.875Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: bootstrap3-typeahead.js Problem Types: CWE-79 Description: Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10215 - https://access.redhat.com/errata/RHSA-2019:3771 - http://lists.opensuse.org/opensuse-security-an
cgi?id=CVE-2019-10215 - https://access.redhat.com/errata/RHSA-2019:3771 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html
CVE ID: CVE-2019-10216 State: PUBLISHED Published: 2019-11-27T12:10:12 Last Updated: 2024-08-04T22:17:18.936Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ghostscript Products: ghostscript Problem Types: CWE-648 Description: In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-1021
ditional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10216 - http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5b85ddd19 - https://security.gentoo.org/glsa/202004-03
CVE ID: CVE-2019-10217 State: PUBLISHED Published: 2019-11-25T15:06:19 Last Updated: 2024-08-04T22:17:18.921Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Ansible Problem Types: CWE-200 Description: A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. Additional Analyst Notes: - CVE Program Container: References: -
d be leak as an output when running ansible playbooks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10217 - https://github.com/ansible/ansible/issues/56269 - https://github.com/ansible/ansible/pull/59427 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
CVE ID: CVE-2019-10218 State: PUBLISHED Published: 2019-11-06T00:00:00 Last Updated: 2024-08-04T22:17:19.002Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Samba Products: samba Problem Types: CWE-22 Description: A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. Additional Analyst Notes: - CVE Program Co
ide of the current working directory using the privileges of the client user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218 - https://www.samba.org/samba/security/CVE-2019-10218.html - https://www.synology.com/security/advisory/Synology_SA_19_35 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/ - https://lists.fedoraproject.org
t/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/ - https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html - https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
CVE ID: CVE-2019-10219 State: PUBLISHED Published: 2019-11-08T14:46:03.000Z Last Updated: 2025-07-07T13:55:51.360Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Hibernate Products: hibernate-validator Problem Types: CWE-79 Description: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accum
https://lists.apache.org/thread.html/r87b7e2d22982b4ca9f88f5f4f22a19b394d2662415b233582ed22ebf%40%3Cnotifications.accumulo.apache.org%3E - https://lists.apache.org/thread.html/r4f8b4e2541be4234946e40d55859273a7eec0f4901e8080ce2406fe6%40%3Cnotifications.accumulo.apache.org%3E - https://lists.apache.org/thread.html/r4f92d7f7682dcff92722fa947f9e6f8ba2227c5dc3e11ba09114897d%40%3Cnotifications.accumulo.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0164 - https://access.redhat.com/errata/RHSA-2020:0159 - https://access.redhat.com/errata/RHSA-2020:0160 - https://access.redhat.com/errata/RHSA-2020:0161 - https://access.redhat.com/errata/RHSA-2020:0445 - https://lists.apache.org/thread.
ss.redhat.com/errata/RHSA-2020:0161 - https://access.redhat.com/errata/RHSA-2020:0445 - https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://github.com/hibernate/hibernate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe - https://github.com/hibernate/hibernate-validator/commi
rnate-validator/commit/20d729548511ac5cff6fd459f93de137195420fe - https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee - https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Adapted/CVE-2019-10219 - https://github.com/poc-effectiveness/PoCAdaptation/tree/main/Origin/CVE-2019-10219/exploit - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10219 - https://security.netapp.com/advisory/ntap-20220210-0024/
CVE ID: CVE-2019-10220 State: PUBLISHED Published: 2019-11-27T15:30:15 Last Updated: 2024-08-04T22:17:19.719Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: SUSE Products: kernel: Problem Types: CWE-22 Description: Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10220 - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4226-1/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://lists.debian.org/debian-lts-announce/2020
- https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
CVE ID: CVE-2019-10221 State: PUBLISHED Published: 2020-03-20T13:55:48 Last Updated: 2024-08-04T22:17:19.703Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: pki-core Problem Types: CWE-79 Description: A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser. Additional Analyst Notes: - CVE Program Container: References: - https
execute arbitrary code when viewed in a browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10221
CVE ID: CVE-2019-10222 State: PUBLISHED Published: 2019-11-08T14:45:41.000Z Last Updated: 2025-02-13T16:27:22.017Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Ceph Project Products: ceph Problem Types: CWE-755 Description: A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients. Additional Analyst Notes: - CVE Program Container: References: - https://tracker.ceph.com/issues/40018 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE
Program Container: References: - https://tracker.ceph.com/issues/40018 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10222 - https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE ID: CVE-2019-10223 State: PUBLISHED Published: 2019-11-05T11:40:37 Last Updated: 2024-08-04T22:17:19.706Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: kube-state-metrics Problem Types: CWE-200 Description: A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exp
ctl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/08/15/8 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10223 - https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2 - https://www.openwall.com/lists/oss-security/2019/08/09/1
CVE ID: CVE-2019-10224 State: PUBLISHED Published: 2019-11-25T00:00:00 Last Updated: 2024-08-04T22:17:18.918Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: 389-ds-base Problem Types: CWE-522 Description: A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/389-ds-base/issue
sitive information. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/389-ds-base/issue/50251 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10224 - https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
CVE ID: CVE-2019-10225 State: PUBLISHED Published: 2021-03-19T20:01:33 Last Updated: 2024-08-04T22:17:20.149Z Vendors: n/a Products: atomic-openshift Problem Types: CWE-522 Description: A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1743073
CVE ID: CVE-2019-10226 State: PUBLISHED Published: 2019-06-10T00:00:00 Last Updated: 2024-08-04T22:17:18.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html - https://www.exploit-db.com/exploits/46617/ - https://github.com/fatfreecrm
263/Fat-Free-CRM-0.19.0-HTML-Injection.html - https://www.exploit-db.com/exploits/46617/ - https://github.com/fatfreecrm/fat_free_crm/issues/1235 - https://github.com/fatfreecrm/fat_free_crm/blob/master/app/views/comments/_comment.html.haml#L2 - https://apidock.com/rails/ActionView/Helpers/TextHelper/simple_format
CVE ID: CVE-2019-10227 State: PUBLISHED Published: 2019-12-31T17:44:02 Last Updated: 2024-08-04T22:17:18.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component. Additional Analyst Notes: - CVE Program Container: References: - https://openitcockpit.io/security/ - https://openitcockpit.io/2019/05/21/openitcockpit-3-7-1-released/
CVE ID: CVE-2019-10229 State: PUBLISHED Published: 2019-12-31T14:25:44 Last Updated: 2024-08-04T22:17:19.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDAP, an attacker is able to login as an existing user with an arbitrary password on the second login attempt. Additional Analyst Notes: - CVE Program Container: References: - https://help.mailstore.com/security/MAILSTORE-SA-2019-01.txt
CVE ID: CVE-2019-10231 State: PUBLISHED Published: 2019-03-27T16:22:43 Last Updated: 2024-08-04T22:17:19.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword() (inc/auth.class.php). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/pull/5520 - https://github.com/glpi-project/glpi/releases/tag/9.4.1.1
CVE ID: CVE-2019-10232 State: PUBLISHED Published: 2019-03-27T16:23:10 Last Updated: 2024-08-04T22:17:20.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/commit/684d4fc423652ec7dde21cac4d41c2df53f56b3c
CVE ID: CVE-2019-10233 State: PUBLISHED Published: 2019-03-27T16:23:27 Last Updated: 2024-08-04T22:17:19.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/releases/tag/9.4.1.1 - https://github.com/glpi-project/glpi/pull/5562
CVE ID: CVE-2019-10237 State: PUBLISHED Published: 2019-03-27T17:45:23 Last Updated: 2024-08-04T22:17:19.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/172/
CVE ID: CVE-2019-10238 State: PUBLISHED Published: 2019-03-27T17:45:38 Last Updated: 2024-08-04T22:17:19.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/175/
CVE ID: CVE-2019-10239 State: PUBLISHED Published: 2019-04-24T14:12:54 Last Updated: 2024-08-04T22:17:19.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Robotronic RunAsSpc 3.7.0.0 protects stored credentials insufficiently, which allows locally authenticated attackers (under the same user context) to obtain cleartext credentials of the stored account. Additional Analyst Notes: - CVE Program Container: References: - https://blog.to.com/advisory-runasspc-cve-2019-10239/
CVE ID: CVE-2019-10240 State: PUBLISHED Published: 2019-04-03T18:04:29 Last Updated: 2024-08-04T22:17:19.603Z Vendors: The Eclipse Foundation Products: Eclipse hawkBit Problem Types: CWE-829, CWE-494 Description: Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=546053
CVE ID: CVE-2019-10241 State: PUBLISHED Published: 2019-04-22T20:14:49 Last Updated: 2024-08-04T22:17:19.587Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-79 Description: In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/464892b514c029dfc0c8656a93e1c0de983c473df70fdadbd224e09f%40%3Cjira.kafka.apache.org%3E - https://lists.apache.o
ead.html/464892b514c029dfc0c8656a93e1c0de983c473df70fdadbd224e09f%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/d7c4a664a34853f57c2163ab562f39802df5cf809523ea40c97289c1%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/bcfb37bfba7b3d7e9c7808b5e5a38a98d6bb714d52cf5162bdd48e32%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/01e004c3f7c7365863a27e7038b7f32dae56ccf3a496b277c9b7f7b6%40%3Cjira.kafka.apache.org%3E - https://lists.apache.org/thread.html/8bff534863c7aaf09bb17c3d0532777258dd3a5c7ddda34198cc2742%40%3Cdev.kafka.apache.org%3E - https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Ci
fka.apache.org%3E - https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://security.netapp.com/advisory/ntap-20190509-0003/ - https://www.oracle.com/secu
dvisory/cpuoct2019-5072832.html - https://security.netapp.com/advisory/ntap-20190509-0003/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121 - https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html - https://www.debian.org/security/2021/dsa-4949
CVE ID: CVE-2019-10242 State: PUBLISHED Published: 2019-04-09T15:42:42 Last Updated: 2024-08-04T22:17:20.146Z Vendors: The Eclipse Foundation Products: Eclipse Kura Problem Types: CWE-22 Description: In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number of file types. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835 - http://www.securityfocus.com/bid/107844
CVE ID: CVE-2019-10243 State: PUBLISHED Published: 2019-04-09T15:42:42 Last Updated: 2024-08-04T22:17:19.791Z Vendors: The Eclipse Foundation Products: Eclipse Kura Problem Types: CWE-497 Description: In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifically craft attacks to the web server run by Kura. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=545834 - http://www.securityfocus.com/bid/107844
CVE ID: CVE-2019-10244 State: PUBLISHED Published: 2019-04-09T15:42:42 Last Updated: 2024-08-04T22:17:19.931Z Vendors: The Eclipse Foundation Products: Eclipse Kura Problem Types: CWE-611 Description: In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an improper factory and parser initialisation. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=545835 - http://www.securityfocus.com/bid/107844
CVE ID: CVE-2019-10245 State: PUBLISHED Published: 2019-04-19T13:43:31 Last Updated: 2024-08-04T22:17:19.773Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-20 Description: In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=545588 - http://www.securityfocus.com/bid/108094 - https://access.redhat.com/errata/RHSA-2019:1164 - https://access.redhat.com/errata/RHS
ww.securityfocus.com/bid/108094 - https://access.redhat.com/errata/RHSA-2019:1164 - https://access.redhat.com/errata/RHSA-2019:1163 - https://access.redhat.com/errata/RHSA-2019:1165 - https://access.redhat.com/errata/RHSA-2019:1166 - https://access.redhat.com/errata/RHSA-2019:1238 - https://access.redhat.com/errata/RHSA-2019:1325
CVE ID: CVE-2019-10246 State: PUBLISHED Published: 2019-04-22T20:14:49 Last Updated: 2024-08-04T22:17:19.655Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-213 Description: In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b