Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-4447 State: PUBLISHED Published: 2016-06-09T16:00:00 Last Updated: 2024-08-06T00:32:25.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10170 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-secur
dex?page=content&id=SB10170 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722 - http://www.securityfocus.com/bid/90864 - https://access.redhat.com/errata/RHSA-2016:1292 - http://www.openwall.com/lists/oss-security/2016/05/25/2 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://www.debian.org/security/2016/dsa-3593 - http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html - http://xmlsoft.org/news.html - https://support.apple.com/HT
pple.com/archives/security-announce/2016/Jul/msg00001.html - http://xmlsoft.org/news.html - https://support.apple.com/HT206901 - http://www.ubuntu.com/usn/USN-2994-1 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83 - http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html - https://www.tenable.com/security/tns-2016-18 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - https://support.apple.com/HT206905 - http://www.securitytracker.com/id/1036348 - https://support.apple.com/HT206
.html - https://support.apple.com/HT206905 - http://www.securitytracker.com/id/1036348 - https://support.apple.com/HT206903 - https://support.apple.com/HT206902 - https://support.apple.com/HT206904 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709 - https://support.apple.com/HT206899
CVE ID: CVE-2016-4448 State: PUBLISHED Published: 2016-06-09T16:00:00 Last Updated: 2024-08-06T00:32:24.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10170 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722 - https://access.redhat.com/errata/RHSA-2016:1292 - http://www.openwall.c
re-security&y=2016&m=slackware-security.404722 - https://access.redhat.com/errata/RHSA-2016:1292 - http://www.openwall.com/lists/oss-security/2016/05/25/2 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://www.securityfocus.com/bid/90856 - https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9 - http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html - http://xmlsoft.org/news.html - https://support.apple.com/HT206901 - http://www.oracle.com/technetwor
Jul/msg00001.html - http://xmlsoft.org/news.html - https://support.apple.com/HT206901 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html - https://bugzilla.redhat.com/show_bug.cgi?id=1338700 - http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html - https://www.tenable.com/security/tns-2016-18 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - https://support.apple.com/HT206905 - http://www.securitytracker.com/id/1036348 - https://support.apple.com/HT206903 - https://support.apple.com/HT206902 - https://support.apple.com/HT206904 - https://h20566.www2.hpe.com/portal/si
206903 - https://support.apple.com/HT206902 - https://support.apple.com/HT206904 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709 - https://support.apple.com/HT206899 - https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
CVE ID: CVE-2016-4449 State: PUBLISHED Published: 2016-06-09T16:00:00 Last Updated: 2024-08-06T00:32:25.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - https://support.cybozu.com/ja-jp/article/9735 - https://kc.mcafee.com/corporate/index?page=content
ul2016-3090546.html - https://support.cybozu.com/ja-jp/article/9735 - https://kc.mcafee.com/corporate/index?page=content&id=SB10170 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722 - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - http://jvn.jp/en/jp/JVN17535578/index.html - https://access.redhat.com/errata/RHSA-2016:1292 - http://www.openwall.com/lists/oss-security/2016/05/25/2 - https://www.debian.org/security/2016/dsa-3593 - http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html - http://lists.apple.com/archives/se
003.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html - http://xmlsoft.org/news.html - https://support.apple.com/HT206901 - http://www.ubuntu.com/usn/USN-2994-1 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html - http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000066.html - http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html - https://www.tenable.com/security/tns-2016-18 - http://www.securityfocus.com/bid/90865 - https://git.gnome.org/browse/libxml2/commit/?id=b1d
.com/security/tns-2016-18 - http://www.securityfocus.com/bid/90865 - https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - https://support.apple.com/HT206905 - http://www.securitytracker.com/id/1036348 - https://support.apple.com/HT206903 - https://support.apple.com/HT206902 - https://support.apple.com/HT206904 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709 - https://support.apple.com/HT206899
CVE ID: CVE-2016-4450 State: PUBLISHED Published: 2016-06-07T14:00:00 Last Updated: 2024-08-06T00:32:25.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036019 - https://security.gentoo.org/glsa/201606-06 - http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html - http://www.ubuntu.com/usn/USN-2991-1 - http://www.de
ttp://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html - http://www.ubuntu.com/usn/USN-2991-1 - http://www.debian.org/security/2016/dsa-3592 - https://access.redhat.com/errata/RHSA-2016:1425 - http://www.securityfocus.com/bid/90967
CVE ID: CVE-2016-4451 State: PUBLISHED Published: 2016-08-19T21:00:00 Last Updated: 2024-08-06T00:32:25.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0336 - https://theforeman.org/security.html#2016-4451 - http://projects.theforeman.org/projects/foreman/reposit
HSA-2018:0336 - https://theforeman.org/security.html#2016-4451 - http://projects.theforeman.org/projects/foreman/repository/revisions/1144040f444b4bf4aae81940a150b26b23b4623c - http://projects.theforeman.org/issues/15182
CVE ID: CVE-2016-4452 State: REJECTED Published: 2022-07-28T16:44:14 Last Updated: 2022-07-28T16:44:14 Description: No description available.
CVE ID: CVE-2016-4453 State: PUBLISHED Published: 2016-06-01T22:00:00 Last Updated: 2024-08-06T00:32:24.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-3047-1 - https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05270.html - https://security.gentoo.org/glsa/201609-01 - http://www.ubuntu.com/usn/USN-3047-2 - https://bugzilla.redhat.com/show_bug.cgi?id=1336650 - http://www.securityfocus.com/bid
//www.ubuntu.com/usn/USN-3047-2 - https://bugzilla.redhat.com/show_bug.cgi?id=1336650 - http://www.securityfocus.com/bid/90928 - http://www.openwall.com/lists/oss-security/2016/05/30/2 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
CVE ID: CVE-2016-4454 State: PUBLISHED Published: 2016-06-01T22:00:00 Last Updated: 2024-08-06T00:32:25.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-3047-1 - http://www.openwall.com/lists/oss-security/2016/05/30/3 - https://security.gentoo.org/glsa/201609-01 - http://www.ubuntu.com/usn/USN-304
all.com/lists/oss-security/2016/05/30/3 - https://security.gentoo.org/glsa/201609-01 - http://www.ubuntu.com/usn/USN-3047-2 - https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05271.html - http://www.securityfocus.com/bid/90927 - https://bugzilla.redhat.com/show_bug.cgi?id=1336429 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
CVE ID: CVE-2016-4455 State: PUBLISHED Published: 2017-04-14T18:00:00 Last Updated: 2024-08-06T00:32:25.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1340525 - http://www.securitytracker.com/id/1038083 - http://www.openwall.com/lists/oss-security/2016/10/26/5 - http://www.securityfocus.com/bid/93926 - http://rhn.red
8083 - http://www.openwall.com/lists/oss-security/2016/10/26/5 - http://www.securityfocus.com/bid/93926 - http://rhn.redhat.com/errata/RHSA-2016-2592.html - https://github.com/candlepin/subscription-manager/commit/9dec31 - https://github.com/candlepin/subscription-manager/blob/subscription-manager-1.17.7-1/subscription-manager.spec - http://rhn.redhat.com/errata/RHSA-2017-0698.html
CVE ID: CVE-2016-4456 State: PUBLISHED Published: 2017-08-08T21:00:00 Last Updated: 2024-08-06T00:32:25.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1343505 - http://www.openwall.com/lists/oss-security/2016/06/07/6
CVE ID: CVE-2016-4457 State: PUBLISHED Published: 2017-06-08T18:00:00 Last Updated: 2024-08-06T00:32:25.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1601 - https://access.redhat.com/errata/RHSA-2017:1367 - https://bugzilla.redhat.com/show_bug.cgi?id=1341308 - http://www.securitytracker.com/id/1038599
CVE ID: CVE-2016-4458 State: REJECTED Published: 2022-07-28T16:45:18 Last Updated: 2022-07-28T16:45:18 Description: No description available.
CVE ID: CVE-2016-4459 State: PUBLISHED Published: 2017-04-12T20:00:00 Last Updated: 2024-08-06T00:32:25.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-2056.html - http://rhn.redhat.com/errata/RHSA-2016-2055.html - https://access.redhat.com/errata/RHSA-2017:0194 - https://access.redhat.com/errata/RHSA-2017:0193 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - http://rhn.redhat.com/errata/RHSA-2016-2054.html - http://www.securityfocus.com/bid/93555 - https://bugzilla.redhat.com/show_bug.cgi?id
at.com/errata/RHSA-2016-2054.html - http://www.securityfocus.com/bid/93555 - https://bugzilla.redhat.com/show_bug.cgi?id=1341583
CVE ID: CVE-2016-4460 State: PUBLISHED Published: 2017-08-22T18:00:00 Last Updated: 2024-08-06T00:32:25.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100449 - http://markmail.org/message/jy7o23cppny26icu
CVE ID: CVE-2016-4461 State: PUBLISHED Published: 2017-10-16T16:00:00 Last Updated: 2024-08-06T00:32:25.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91277 - https://struts.apache.org/docs/s2-036.html - https://security.netapp.com/advisory/ntap-20180629-0004/
CVE ID: CVE-2016-4462 State: PUBLISHED Published: 2017-08-30T17:00:00Z Last Updated: 2024-09-17T00:30:36.308Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: Information Disclosure Description: By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01 Additional Analyst Notes: - CVE Program Container: References: - http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html
CVE ID: CVE-2016-4463 State: PUBLISHED Published: 2016-07-08T19:00:00 Last Updated: 2024-08-06T00:32:25.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://issues.apache.org/jira/browse/XERCESC-2069 - https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10510&version=12336069 - https://access.redhat.com/errata/RHSA-2018:3335 - https://www.debian.org/security/2016/dsa-3610
10510&version=12336069 - https://access.redhat.com/errata/RHSA-2018:3335 - https://www.debian.org/security/2016/dsa-3610 - http://www.securitytracker.com/id/1036211 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00013.html - https://access.redhat.com/errata/RHSA-2018:3506 - https://access.redhat.com/errata/RHSA-2018:3514 - http://www.securityfocus.com/bid/91501 - http://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt - http://www.securityfocus.com/archive/1/538784/100/0/threaded - http://packetstormsecurity.com/files/137714/Apache-Xerces-C-XML-Parser-Crash.html - http://lists.opensuse.org/opensuse-updates/2016-07/msg00053.html - https://www.oracle.com/security-alerts/cpuapr2020.
- http://lists.opensuse.org/opensuse-updates/2016-07/msg00053.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2016-4464 State: PUBLISHED Published: 2016-09-21T18:00:00 Last Updated: 2024-08-06T00:32:25.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036869 - http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.asc - http://www.securityfocus.com/b
r.com/id/1036869 - http://cxf.apache.org/security-advisories.data/CVE-2016-4464.txt.asc - http://www.securityfocus.com/bid/92905 - http://www.openwall.com/lists/oss-security/2016/09/08/20 - https://git-wip-us.apache.org/repos/asf?p=cxf-fediz.git%3Ba=commit%3Bh=0006581e9cacbeef46381a223e5671e524d416b6 - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://list
.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2016-4465 State: PUBLISHED Published: 2016-07-04T22:00:00 Last Updated: 2024-08-06T00:32:25.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1348253 - http://www.securityfocus.com/bid/91278 - https://struts.apache.org/docs/s2-041.html - http://www-01.ibm.com/support/docview.wss?uid=swg21987854 - http://jvn.jp/en/jp/JVN12352818/index.html - http://www.oracle.com/technetwork/security-adv
ocview.wss?uid=swg21987854 - http://jvn.jp/en/jp/JVN12352818/index.html - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://jvndb.jvn.jp/jvndb/JVNDB-2016-000114
CVE ID: CVE-2016-4466 State: REJECTED Published: 2018-07-09T16:00:00 Last Updated: 2018-07-09T15:57:01 Description: No description available.
CVE ID: CVE-2016-4467 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-06T00:32:25.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91788 - http://www.openwall.com/lists/oss
Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91788 - http://www.openwall.com/lists/oss-security/2016/07/15/3 - http://www.securitytracker.com/id/1036316 - https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E
CVE ID: CVE-2016-4468 State: PUBLISHED Published: 2017-04-11T15:00:00 Last Updated: 2024-08-06T00:32:25.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/WMTZBIH5U7DTOOX2SNR
r: References: - https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/WMTZBIH5U7DTOOX2SNRVTPQI3U2AINOB/ - https://pivotal.io/security/cve-2016-4468
CVE ID: CVE-2016-4469 State: PUBLISHED Published: 2016-07-28T16:00:00 Last Updated: 2024-08-06T00:32:25.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/add
oken parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137869/Apache-Archiva-1.3.9-Cross-Site-Request-Forgery.html - http://seclists.org/fulldisclosure/2016/Jul/37 - http://www.securitytracker.com/id/1036475 - http://www.securityfocus.com/archive/1/538877/100/0/threaded - http://www.securityfocus.com/bid/91703 - https://www
75 - http://www.securityfocus.com/archive/1/538877/100/0/threaded - http://www.securityfocus.com/bid/91703 - https://www.exploit-db.com/exploits/40109/ - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E