Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7157 State: PUBLISHED Published: 2017-12-25T21:00:00 Last Updated: 2024-08-05T15:56:35.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102181 - htt
CVE ID: CVE-2017-7158 State: PUBLISHED Published: 2017-12-25T21:00:00 Last Updated: 2024-08-05T15:56:34.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Screen Sharing Server" component. It allows attackers to obtain root privileges for reading files by leveraging screen-sharing access. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331
CVE ID: CVE-2017-7159 State: PUBLISHED Published: 2017-12-25T21:00:00 Last Updated: 2024-08-05T15:56:36.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOAcceleratorFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331
CVE ID: CVE-2017-7160 State: PUBLISHED Published: 2017-12-25T21:00:00 Last Updated: 2024-08-05T15:56:36.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208327 - https://
CVE ID: CVE-2017-7161 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:36.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code via special characters that trigger command injection. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208324 - https://usn.ubuntu.com/3551-1/
CVE ID: CVE-2017-7162 State: PUBLISHED Published: 2017-12-25T21:00:00 Last Updated: 2024-08-05T15:56:36.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331 - https://support.apple.com/HT208327 - https://support.apple.com/HT208325 -
ences: - https://support.apple.com/HT208331 - https://support.apple.com/HT208327 - https://support.apple.com/HT208325 - https://support.apple.com/HT208334
CVE ID: CVE-2017-7163 State: PUBLISHED Published: 2017-12-25T21:00:00 Last Updated: 2024-08-05T15:56:36.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331
CVE ID: CVE-2017-7164 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:36.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. The issue involves the "App Store" component. It allows man-in-the-middle attackers to spoof password prompts. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208327 - https://support.apple.com/HT208334
CVE ID: CVE-2017-7165 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:34.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://suppo
pplication crash) via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208327 - https://support.apple.com/HT208325 - https://support.apple.com/HT208334 - https://support.apple.com/HT208324 - https://support.apple.com/HT208326 - https://usn.ubuntu.com/3551-1/ - https://support.apple.com/HT208328
CVE ID: CVE-2017-7166 State: REJECTED Published: N/A Last Updated: 2023-09-14T18:41:30.996Z Description: No description available.
CVE ID: CVE-2017-7167 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:36.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. Xcode before 9.2 is affected. The issue involves the "ld64" component. A buffer overflow allows remote attackers to execute arbitrary code via crafted source code. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208456
CVE ID: CVE-2017-7168 State: REJECTED Published: N/A Last Updated: 2023-09-14T18:41:31.373Z Description: No description available.
CVE ID: CVE-2017-7169 State: REJECTED Published: N/A Last Updated: 2023-09-14T18:41:31.733Z Description: No description available.
CVE ID: CVE-2017-7170 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:36.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Security" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208221
CVE ID: CVE-2017-7171 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:35.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "CoreAnimation" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331 - https://support.apple.com/HT208327 - https://support.apple.com/HT2
r: References: - https://support.apple.com/HT208331 - https://support.apple.com/HT208327 - https://support.apple.com/HT208325 - https://support.apple.com/HT208334
CVE ID: CVE-2017-7172 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:36.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "CFNetwork Session" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://supp
ice (memory corruption) via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331 - https://support.apple.com/HT208327 - https://support.apple.com/HT208325 - https://support.apple.com/HT208334 - https://support.apple.com/HT208326 - https://support.apple.com/HT208328
CVE ID: CVE-2017-7173 State: PUBLISHED Published: 2018-04-03T06:00:00 Last Updated: 2024-08-05T15:56:35.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208331
CVE ID: CVE-2017-7174 State: PUBLISHED Published: 2017-03-17T23:00:00 Last Updated: 2024-08-05T15:56:36.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: The user-account creation feature in Chef Manage 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This is fixed in 2.4.5. Additional Analyst Notes: - CVE Program Container: References: - https://discourse.chef.io/t/chef-manage-2-4-5-security-release/10599 - http://www.securityfocus.com/bid/97069
CVE ID: CVE-2017-7175 State: PUBLISHED Published: 2017-07-10T19:00:00 Last Updated: 2024-08-05T15:56:36.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the "Custom output format" field). Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/nfsen/news/2017/01/nfsen-138-released---security-fix/ - https://www.exploit-db.com/exploits/42314/
CVE ID: CVE-2017-7176 State: REJECTED Published: 2018-05-04T14:00:00 Last Updated: 2018-05-04T13:57:02 Description: No description available.
CVE ID: CVE-2017-7177 State: PUBLISHED Published: 2017-03-18T20:10:00 Last Updated: 2024-08-05T15:56:36.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Suricata before 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html - https://github.com/inliniac/suricata/commit/4a04f814b15762eb446a5ead4d69d021512df6f8 - https://redmine.openinfosecfoundation.org/issues/2019 - http://www.securityfocus.com/bid/97047
CVE ID: CVE-2017-7178 State: PUBLISHED Published: 2017-03-18T20:10:00 Last Updated: 2024-08-05T15:56:36.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin. Additional Analyst Notes: - CVE Program Container: References: - http://git.deluge-torrent.org/deluge/commit/?h=develop&id=11e8957deaf0c76fdfbac62d99c8b6c61cfdddf9 - http://dev.deluge-torrent.org/wiki/ReleaseNotes/1.3.14 - http://www.securityfocus.com/bid/97041 - https://
6c61cfdddf9 - http://dev.deluge-torrent.org/wiki/ReleaseNotes/1.3.14 - http://www.securityfocus.com/bid/97041 - https://bugs.debian.org/857903 - http://seclists.org/fulldisclosure/2017/Mar/6 - http://www.debian.org/security/2017/dsa-3856 - https://security.gentoo.org/glsa/201703-06 - http://git.deluge-torrent.org/deluge/commit/?h=1.3-stable&id=318ab179865e0707d7945edc3a13a464a108d583
CVE ID: CVE-2017-7180 State: PUBLISHED Published: 2017-06-08T12:00:00 Last Updated: 2024-08-05T15:56:35.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design goal. The local attacker must have privileges to write to program.exe in a protected directory, such as the %SYSTEMDRIVE% directory, and thus the issue is not interpreted as a direct privilege escalation. However, the local attacker might have the goal of executing program.exe even though program.exe is a blocked application. Additional Analyst Notes: - CVE Program Conta
of executing program.exe even though program.exe is a blocked application. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42141/
CVE ID: CVE-2017-7183 State: PUBLISHED Published: 2017-03-27T17:00:00 Last Updated: 2024-08-05T15:56:36.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) write TFTP protocol message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96973 - http://packetstormsecurity.com/files/141705/ExtraPuTTY-029_rc2-Denial-Of-Service.html - https://www.exploit-db.com/exploits/41639/ - http://www.securityfocus.com/archive/1/540300/100/0/threaded
CVE ID: CVE-2017-7184 State: PUBLISHED Published: 2017-03-19T18:00:00 Last Updated: 2024-08-05T15:56:35.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52. Additional Analyst Notes: - CVE Program Container: References: - https://blog.trendmicro.co
image-* package 4.8.0.41.52. Additional Analyst Notes: - CVE Program Container: References: - https://blog.trendmicro.com/results-pwn2own-2017-day-one/ - https://access.redhat.com/errata/RHSA-2017:2918 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d916052585301785d847c3b3e6186a - https://access.redhat.com/errata/RHSA-2017:2931 - http://www.securityfocus.com/bid/97018 - https://source.android.com/security/bulletin/2017-05-01 - http://www.securitytracker.com/id/1038166 - https://github.com/torvalds/linux/commit/f843ee6dd019bcece3e74e76ad9df0155655d0df - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9d
d9df0155655d0df - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df - http://www.eweek.com/security/ubuntu-linux-falls-on-day-1-of-pwn2own-hacking-competition - https://github.com/torvalds/linux/commit/677e806da4d916052585301785d847c3b3e6186a - https://twitter.com/thezdi/status/842126074435665920 - http://openwall.com/lists/oss-security/2017/03/29/2 - https://access.redhat.com/errata/RHSA-2017:2930 - https://access.redhat.com/errata/RHSA-2019:4159
CVE ID: CVE-2017-7185 State: PUBLISHED Published: 2017-04-10T15:00:00 Last Updated: 2024-08-05T15:56:36.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string. Additional Analyst Notes: - CVE Program Container: References: - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt - http://www.securityfocus.co
rity.com/fileadmin/Datein/Research/Advisories/CVE-2017-7185_mongoose_os_use_after_free.txt - http://www.securityfocus.com/bid/97370 - http://www.securityfocus.com/archive/1/540355/100/0/threaded - https://github.com/cesanta/mongoose-os/commit/042eb437973a202d00589b13d628181c6de5cf5b - https://github.com/cesanta/mongoose/commit/b8402ed0733e3f244588b61ad5fedd093e3cf9cc - https://www.exploit-db.com/exploits/41826/
CVE ID: CVE-2017-7186 State: PUBLISHED Published: 2017-03-20T00:00:00 Last Updated: 2024-08-05T15:56:36.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.exim.org/show_bug.cgi?id=2052 - https://security.gentoo.org/glsa/201710-09 - https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date - https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortb
_internal.h?r1=1649&r2=1688&sortby=date - https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=date - https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date - http://www.securityfocus.com/bid/97030 - https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/ - https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=date - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201710-25
CVE ID: CVE-2017-7187 State: PUBLISHED Published: 2017-03-20T14:00:00 Last Updated: 2024-08-05T15:56:36.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2017-10-01 - https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.11/scsi-f
/security/bulletin/pixel/2017-10-01 - https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.11/scsi-fixes&id=bf33f87dd04c371ea33feb821b60d63d754e3124 - https://access.redhat.com/errata/RHSA-2017:2669 - http://www.securitytracker.com/id/1038086 - https://access.redhat.com/errata/RHSA-2017:2077 - https://gist.github.com/dvyukov/48ad14e84de45b0be92b7f0eda20ff1b - https://access.redhat.com/errata/RHSA-2017:1842 - http://www.securityfocus.com/bid/96989
CVE ID: CVE-2017-7188 State: PUBLISHED Published: 2017-04-14T18:00:00 Last Updated: 2024-08-05T15:56:36.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/zurmo/zurmo/issues/426/to-report-a-xss-security-vulnerability-in - https://github.com/faizzaidi/Zurmo-Stable-3.1.1-XSS-By-Provensec-LLC - http://www.securityfocus.com/bid/97681
CVE ID: CVE-2017-7189 State: PUBLISHED Published: 2019-07-10T14:41:35 Last Updated: 2024-08-05T15:56:36.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input. Additional Analyst Notes: - CVE Program Container: Refe
127.0.0.1:80 in this example) is obtained from untrusted input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a - https://bugs.php.net/bug.php?id=74192
CVE ID: CVE-2017-7191 State: PUBLISHED Published: 2017-03-27T17:00:00 Last Updated: 2024-08-05T15:56:36.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/irssi/irssi/commit/77b2631c78461965bc9a7414aae206b5c514e1b3 - http://www.securityfocus.com/bid/97185 - https://irssi.org/security/irssi_sa_2017_03.txt
CVE ID: CVE-2017-7192 State: PUBLISHED Published: 2017-04-06T14:00:00 Last Updated: 2024-08-05T15:56:36.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daltoniam/Starscream/releases/tag/2.0.4 - https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6 - http://seclists.org/bugtraq/2017/Apr/66
CVE ID: CVE-2017-7199 State: PUBLISHED Published: 2017-03-23T16:00:00 Last Updated: 2024-08-05T15:56:35.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the software is running in Agent Mode. Version 6.10.4 fixes this issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97110 - https://www.tenable.com/security/tns-2017-08 - https://aspe1337.blogspot.nl/2017/04/writeup-of-cve-2017-7199.html - http://www.securitytracker.com/id/1038124
CVE ID: CVE-2017-7200 State: PUBLISHED Published: 2017-03-21T06:21:00 Last Updated: 2024-08-05T15:56:36.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96988 - h
age service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96988 - https://bugs.launchpad.net/ossn/+bug/1153614 - https://wiki.openstack.org/wiki/OSSN/OSSN-0078 - https://bugs.launchpad.net/ossn/+bug/1606495