Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-14295 State: PUBLISHED Published: 2020-06-17T13:47:36 Last Updated: 2024-08-04T12:39:36.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/3622 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKM5G3YNSZDHDZMPCMAHG5B5M2V4XYSE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa
DHDZMPCMAHG5B5M2V4XYSE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W64CIB6L4HZRVQSWKPDDKXJO4J2XTOXD/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html - https://security.gentoo.org/glsa/202007-03 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html - http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html - http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html
CVE ID: CVE-2020-14296 State: PUBLISHED Published: 2020-08-11T13:14:57 Last Updated: 2024-08-04T12:39:36.243Z Vendors: n/a Products: CloudForms Problem Types: Server-Side Request Forgery (SSRF) Description: Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1847860 - https://access.redhat.com/security/cve/cve-2020-14296
CVE ID: CVE-2020-14297 State: PUBLISHED Published: 2020-07-24T15:37:25 Last Updated: 2024-10-15T17:14:53.962Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: wildfly Problem Types: CWE-400 Description: A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_b
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297
CVE ID: CVE-2020-14298 State: PUBLISHED Published: 2020-07-13T20:53:26 Last Updated: 2024-08-04T12:39:36.209Z Vendors: n/a Products: Docker Problem Types: Regression Description: The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.
13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2020-14298 - https://access.redhat.com/security/vulnerabilities/runcescape - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-5736 - https://access.redhat.com/errata/RHBA-2020:0427
CVE ID: CVE-2020-14299 State: PUBLISHED Published: 2020-10-16T13:10:43 Last Updated: 2024-08-04T12:39:36.239Z Vendors: n/a Products: picketbox Problem Types: CWE-287 Description: A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. This flaw allows an attacker to perform a complete authentication bypass by using an arbitrary user and password. The highest threat to vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1848533
CVE ID: CVE-2020-14300 State: PUBLISHED Published: 2020-07-13T21:02:24 Last Updated: 2024-08-04T12:39:36.319Z Vendors: n/a Products: Docker Problem Types: Regression Description: The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 w
Hat Enterprise Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300 was assigned to this security regression and it is specific to the docker packages produced by Red Hat. The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a process entering container namespace and execute arbitrary code outside of the container. This could lead to compromise of the container host or other containers running on the same container host. This issue only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected. Additional Ana
-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7. Both earlier and later versions are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHBA-2020:0427 - https://access.redhat.com/security/cve/CVE-2016-9962 - https://access.redhat.com/security/vulnerabilities/cve-2016-9962 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9962
CVE ID: CVE-2020-14301 State: PUBLISHED Published: 2021-05-27T19:44:34 Last Updated: 2024-08-04T12:39:36.274Z Vendors: n/a Products: libvirt Problem Types: CWE-212 Description: An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1848640 - https://security.netapp.com/advisory/ntap-20210629-0007/
CVE ID: CVE-2020-14302 State: PUBLISHED Published: 2020-12-15T19:06:15 Last Updated: 2024-08-04T12:39:36.203Z Vendors: n/a Products: keycloak Problem Types: CWE-294 Description: A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1849584
CVE ID: CVE-2020-14303 State: PUBLISHED Published: 2020-07-06T17:12:08 Last Updated: 2024-08-04T12:39:36.168Z Vendors: n/a Products: Samba Problem Types: Uncontrolled Resource Consumption Description: A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1851298%3B - https://www.samba.org/samba/security/CVE-2020-14303.html - https://security.netapp.com/advisory/ntap-20200709-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40l
://security.netapp.com/advisory/ntap-20200709-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html - https://security.gentoo.org/glsa/202007-15 - https://usn.ubuntu.com/4454-2/ - https://usn.ubuntu.com/4454-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html
CVE ID: CVE-2020-14304 State: PUBLISHED Published: 2020-09-15T19:40:44 Last Updated: 2024-08-04T12:39:36.607Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux Kernel Products: kernel Problem Types: CWE-460 Description: A memory disclosure flaw was found in the Linux kernel's ethernet drivers, in the way it read data from the EEPROM of the device. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14304 - https://bugs.debian.org/cgi-bin/bugre
tainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14304 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960702
CVE ID: CVE-2020-14305 State: PUBLISHED Published: 2020-12-02T00:48:25 Last Updated: 2024-08-04T12:39:36.220Z Vendors: n/a Products: kernel Problem Types: CWE-787 Description: An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1850716 - https://bugs.openvz.org/browse/OVZ
rogram Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1850716 - https://bugs.openvz.org/browse/OVZ-7188 - https://patchwork.ozlabs.org/project/netfilter-devel/patch/c2385b5c-309c-cc64-2e10-a0ef62897502%40virtuozzo.com/ - https://security.netapp.com/advisory/ntap-20201210-0004/
CVE ID: CVE-2020-14306 State: PUBLISHED Published: 2020-09-16T00:00:00 Last Updated: 2024-08-04T12:39:36.236Z Vendors: n/a Products: openshift-service-mesh/istio-rhel8-operator Problem Types: CWE-862 Description: An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: R
data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maistra/istio-operator/pull/462 - https://bugzilla.redhat.com/show_bug.cgi?id=1850380
CVE ID: CVE-2020-14307 State: PUBLISHED Published: 2020-07-24T00:00:00 Last Updated: 2024-08-04T12:39:36.215Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: wildfly Problem Types: CWE-404 Description: A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redh
to make the service unavailable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307
CVE ID: CVE-2020-14308 State: PUBLISHED Published: 2020-07-29T19:03:41 Last Updated: 2024-08-04T12:39:36.360Z Vendors: n/a Products: Grub Problem Types: Integer Overflow or Wraparound leading to Heap-based Buffer Overflow Description: In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1852009 - http://www.openwall.com/li
- CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1852009 - http://www.openwall.com/lists/oss-security/2020/07/29/3 - https://security.netapp.com/advisory/ntap-20200731-0008/ - https://usn.ubuntu.com/4432-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html - https://security.gentoo.org/glsa/202104-05 - http://www.openwall.com/lists/oss-security/2021/09/17/2 - http://www.openwall.com/lists/oss-security/2021/09/17/4 - http://www.openwall.com/lists/oss-security/2021/09/21/1
CVE ID: CVE-2020-14309 State: PUBLISHED Published: 2020-07-30T12:49:31 Last Updated: 2024-08-04T12:39:36.530Z Vendors: n/a Products: Grub Problem Types: Integer Overflow or Wraparound leading to Heap-based Buffer Overflow Description: There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1852022 - https://security.netapp.com/ad
VE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1852022 - https://security.netapp.com/advisory/ntap-20200731-0008/ - https://usn.ubuntu.com/4432-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html - https://security.gentoo.org/glsa/202104-05
CVE ID: CVE-2020-14310 State: PUBLISHED Published: 2020-07-31T20:55:55 Last Updated: 2024-08-04T12:39:36.404Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: The Grub2 Project Products: grub2 Problem Types: CWE-190, CWE-122 Description: There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized all
ont file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310 - https://usn.ubuntu.com/4432-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html - https://security.gentoo.org/glsa/202104-05
CVE ID: CVE-2020-14311 State: PUBLISHED Published: 2020-07-31T20:56:30 Last Updated: 2024-08-04T12:39:36.229Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: The Grub2 Project Products: grub2 Problem Types: CWE-190, CWE-122 Description: There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arithmetic overflow leading to a zero-sized memory allocation with subsequent heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14311 - https://usn.ubuntu.com
CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14311 - https://usn.ubuntu.com/4432-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html - https://security.gentoo.org/glsa/202104-05 - http://www.openwall.com/lists/oss-security/2021/09/17/2 - http://www.openwall.com/lists/oss-security/2021/09/17/4 - http://www.openwall.com/lists/oss-security/2021/09/21/1
CVE ID: CVE-2020-14312 State: PUBLISHED Published: 2021-02-05T23:16:33 Last Updated: 2024-08-04T12:39:36.268Z Vendors: n/a Products: dnsmasq Problem Types: CWE-284 Description: A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems
ss on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1851342
CVE ID: CVE-2020-14313 State: PUBLISHED Published: 2020-08-11T13:42:26 Last Updated: 2024-08-04T12:39:36.208Z Vendors: n/a Products: Quay Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1853026
CVE ID: CVE-2020-14314 State: PUBLISHED Published: 2020-09-15T00:00:00 Last Updated: 2024-08-04T12:39:36.409Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Linux Kernel Products: kernel Problem Types: CWE-125 Description: A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi
Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5872331b3d91820e14716632ebb56b1399b34fe1 - https://lore.kernel.org/linux-ext4/f53e246b-647c-64bb-16ec-135383c70ad7%40redhat.com/T/#u - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14314 - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html - https://usn.ubuntu.com/4576-1/ - https://usn.ubuntu.com/4578-1/ - https://usn.ubuntu.com/4579-1/ - https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html - https://www.starwindsoftware.com/security/sw-20210325-0003/
CVE ID: CVE-2020-14315 State: PUBLISHED Published: 2020-09-16T13:31:19 Last Updated: 2024-08-04T12:39:36.226Z Vendors: n/a Products: bsdiff Problem Types: CWE-787 Description: A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2020/07/09/2 - https://www.x41-dsec.de/lab/advisories/x41-2020-006-bspatch/ - https://bugzilla.redhat.com/show_bug.cgi?id=1856747
CVE ID: CVE-2020-14316 State: PUBLISHED Published: 2020-07-29T18:48:23 Last Updated: 2024-08-04T12:39:36.221Z Vendors: n/a Products: kubevirt Problem Types: Improper Access Control Description: A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Contai
is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1848951
CVE ID: CVE-2020-14317 State: PUBLISHED Published: 2021-06-02T11:27:39 Last Updated: 2024-08-04T12:39:36.235Z Vendors: n/a Products: Wildfly Problem Types: CWE-364 Description: It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing regression. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1854251
CVE ID: CVE-2020-14318 State: PUBLISHED Published: 2020-12-03T00:00:00 Last Updated: 2024-10-29T13:52:19.151Z Vendors: n/a Products: samba Problem Types: CWE-266 Description: A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1892631 - https://www.samba.org/samba/security/CVE-2020-14318.html - https://security.gentoo.org/glsa/202012-24 - https://lists.debian.org/debian-lts-announce/2024/
ty/CVE-2020-14318.html - https://security.gentoo.org/glsa/202012-24 - https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
CVE ID: CVE-2020-14319 State: PUBLISHED Published: 2020-08-03T16:50:39 Last Updated: 2024-08-04T12:39:36.228Z Vendors: n/a Products: AMQ-Online and EnMasse Problem Types: Cross-Site Request Forgery (CSRF) Description: It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not instigated or bypassed. For example authorised users using an older browser with Adobe Flash are vulnerable when targeted by an attacker. This flaw affects all versions of AMQ-Online prior to 1.5.2 and Enmasse versions 0.31.0-rc1 up until but not including 0.32.2. Additional Analyst Notes: - CVE Program Container: References:
se versions 0.31.0-rc1 up until but not including 0.32.2. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1854373