Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d execute arbitrary JavaScript in the user's browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107344 - https://pivotal.io/security/cve-2019-3776
CVE ID: CVE-2019-3777 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-16T21:56:55.392Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Pivotal Products: Apps Manager, Pivotal Application Service Problem Types: CWE-295 Description: Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Cont
tercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107214 - https://pivotal.io/security/cve-2019-3777
CVE ID: CVE-2019-3778 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-16T20:57:23.699Z Vendors: Spring Products: Spring Security OAuth Problem Types: CWE-601 Description: Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource ow
ed redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer),
plementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107153 - https://www.oracle.com/security-alerts/cpujan2021.html - http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html - https://pivotal.io/security/cve-2019-3778
CVE ID: CVE-2019-3779 State: PUBLISHED Published: 2019-03-08T16:00:00Z Last Updated: 2024-09-16T18:55:26.386Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: Cloud Foundry Container Runtime (CFCR) Problem Types: CWE-284 Description: Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the Kubernetes CSR capability to obtain a credential that could escalate privilege access to ETCD. Additional Analyst No
the Kubernetes CSR capability to obtain a credential that could escalate privilege access to ETCD. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3779
CVE ID: CVE-2019-3780 State: PUBLISHED Published: 2019-03-08T16:00:00Z Last Updated: 2024-09-16T22:45:16.571Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cloud Foundry Products: Cloud Foundry Container Runtime (CFCR) Problem Types: CWE-260 Description: Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3780 -
ount. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3780 - http://www.securityfocus.com/bid/107434
CVE ID: CVE-2019-3781 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-16T21:02:38.569Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry Products: CF CLI Problem Types: CWE-215 Description: Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authenticated malicious user with access to logs may gain part or all of a users password. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107365 - https://www.cloudfoundry.org/blog/cve-2019-3781
CVE ID: CVE-2019-3782 State: PUBLISHED Published: 2019-02-13T16:00:00Z Last Updated: 2024-09-16T23:36:58.237Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Cloud Foundry Products: CredHub CLI Problem Types: CWE-522 Description: Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user. Additional Analyst Notes: - CVE Program Container: References: - http
CredHub that are authorized to the targeted user. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3782 - http://www.securityfocus.com/bid/107038
CVE ID: CVE-2019-3783 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-16T23:15:59.788Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry Products: Stratos Problem Types: CWE-384 Description: Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brute force another user's current Stratos session, and act on behalf of that user. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3783
CVE ID: CVE-2019-3784 State: PUBLISHED Published: 2019-03-07T19:00:00Z Last Updated: 2024-09-16T18:56:08.918Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry Products: Stratos Problem Types: CWE-384 Description: Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3784
CVE ID: CVE-2019-3785 State: PUBLISHED Published: 2019-03-13T22:00:00Z Last Updated: 2024-09-17T01:56:39.503Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Cloud Foundry Products: CAPI Problem Types: CWE-285 Description: Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3785 - http://www.securityfocus.com/bid/
CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3785 - http://www.securityfocus.com/bid/107514
CVE ID: CVE-2019-3786 State: PUBLISHED Published: 2019-04-24T15:21:10.353984Z Last Updated: 2024-09-17T02:15:38.765Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Cloud Foundry Products: BOSH Backup and Restore Problem Types: CWE-269 Description: Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. The exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR
exploited hooks in this metadata script were only maintained in the cfcr-etcd-release, so clusters deployed with the BBR job for etcd in this release are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3786
CVE ID: CVE-2019-3787 State: PUBLISHED Published: 2019-06-19T22:28:07.316424Z Last Updated: 2024-09-16T21:57:57.203Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-840 Description: Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account. Additional An
entially fraudulent address. This would allow the attacker to gain complete control of the user's account. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3787
CVE ID: CVE-2019-3788 State: PUBLISHED Published: 2019-04-25T20:17:37.233754Z Last Updated: 2024-09-16T22:02:12.371Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry, Pivotal Products: UAA Release (OSS), Pivotal Application Service Problem Types: CWE-601 Description: Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA access code from the victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloud
et a UAA access code from the victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3788
CVE ID: CVE-2019-3789 State: PUBLISHED Published: 2019-04-24T15:21:10.443296Z Last Updated: 2024-09-17T04:14:31.804Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: CF Routing Problem Types: CWE-840 Description: Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to
p. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3789
CVE ID: CVE-2019-3790 State: PUBLISHED Published: 2019-06-06T19:16:16.854483Z Last Updated: 2024-09-16T22:20:48.221Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Pivotal Products: Pivotal Ops Manager Problem Types: CWE-324 Description: The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources. Additional Analyst Notes: - CVE Program Container: References: - http://
have expired, and access Ops Manager resources. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108512 - https://pivotal.io/security/cve-2019-3790
CVE ID: CVE-2019-3791 State: REJECTED Published: 2019-05-01T17:43:35 Last Updated: 2019-05-01T17:43:35 Description: No description available.
CVE ID: CVE-2019-3792 State: PUBLISHED Published: 2019-04-01T20:54:47.233626Z Last Updated: 2024-09-17T01:46:43.383Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: Pivotal Products: Concourse Problem Types: CWE-89 Description: Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3792
CVE ID: CVE-2019-3793 State: PUBLISHED Published: 2019-04-24T15:21:10.482554Z Last Updated: 2024-09-17T02:42:24.279Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Pivotal Products: Apps Manager Problem Types: CWE-300 Description: Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation service that accepts HTTP. A remote unauthenticated user could listen to network traffic and gain access to the authorization credentials used to make the invitation requests. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019
vitation requests. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3793
CVE ID: CVE-2019-3794 State: PUBLISHED Published: 2019-07-18T15:47:00.225600Z Last Updated: 2024-09-16T16:28:44.977Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-284 Description: Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3794
CVE ID: CVE-2019-3795 State: PUBLISHED Published: 2019-04-09T15:29:02.127885Z Last Updated: 2024-09-17T00:02:03.823Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Spring Products: Spring Security Problem Types: CWE-330 Description: Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection. Additional Analyst Notes: - CVE Program Container: References: - h
dom material available to an attacker for inspection. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3795 - http://www.securityfocus.com/bid/107802 - https://lists.debian.org/debian-lts-announce/2019/05/msg00026.html
CVE ID: CVE-2019-3796 State: REJECTED Published: 2020-02-26T14:56:45 Last Updated: 2020-02-26T14:56:45 Description: No description available.
CVE ID: CVE-2019-3797 State: PUBLISHED Published: 2019-05-06T15:21:37.081031Z Last Updated: 2024-09-16T17:33:03.727Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Spring Products: Spring Boot Problem Types: CWE-89 Description: This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters prop
ined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3797
CVE ID: CVE-2019-3798 State: PUBLISHED Published: 2019-04-17T13:32:35.609682Z Last Updated: 2024-09-17T04:09:11.026Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H) Vendors: Cloud Foundry Products: CAPI-release Problem Types: CWE-287 Description: Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated malicious user with the ability to create UAA clients and knowledge of the email of a victim in the foundation may escalate their privileges to that of the victim by creating a client with a name equal to the guid of their victim. Additional Analyst Notes: - CVE Program
f the victim by creating a client with a name equal to the guid of their victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3798 - http://www.securityfocus.com/bid/108095
CVE ID: CVE-2019-3799 State: PUBLISHED Published: 2019-05-06T15:21:37.135488Z Last Updated: 2024-09-17T00:16:21.820Z Vendors: Spring Products: Spring Cloud Config Problem Types: CWE-22 Description: Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - ht
tional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2022.html - https://pivotal.io/security/cve-2019-3799
CVE ID: CVE-2019-3800 State: PUBLISHED Published: 2019-08-05T16:38:20.424541Z Last Updated: 2024-09-17T04:29:08.973Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Cloud Foundry Products: CF CLI Release, CF CLI Problem Types: CWE-522 Description: CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve
aked credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3800 - https://pivotal.io/security/cve-2019-3800
CVE ID: CVE-2019-3801 State: PUBLISHED Published: 2019-04-25T20:17:37.272844Z Last Updated: 2024-09-17T02:56:41.904Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry, Pivotal Products: CredHub, UAA Release (OSS), cf-deployment, UAA Release (LTS) Problem Types: CWE-494 Description: Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfou
malicious code into the component. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-3801 - http://www.securityfocus.com/bid/108104
CVE ID: CVE-2019-3802 State: PUBLISHED Published: 2019-06-03T13:47:42.791121Z Last Updated: 2024-09-17T00:22:02.219Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Spring Products: Spring Data JPA Problem Types: CWE-155 Description: This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3802
CVE ID: CVE-2019-3803 State: PUBLISHED Published: 2019-01-12T01:00:00Z Last Updated: 2024-09-16T20:36:24.722Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Pivotal Products: Concourse Problem Types: CWE-200 Description: Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-3803
CVE ID: CVE-2019-3804 State: PUBLISHED Published: 2019-03-26T00:00:00 Last Updated: 2024-08-04T19:19:18.489Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: cockpit Problem Types: CWE-909 Description: It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:1569 - https://access.redhat.com/errata/RHSA-2019:15
Container: References: - https://access.redhat.com/errata/RHSA-2019:1569 - https://access.redhat.com/errata/RHSA-2019:1571 - https://github.com/cockpit-project/cockpit/pull/10819 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3804 - https://github.com/cockpit-project/cockpit/commit/c51f6177576d7e12
CVE ID: CVE-2019-3805 State: PUBLISHED Published: 2019-05-03T19:25:28 Last Updated: 2024-08-04T19:19:18.533Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: wildfly Problem Types: CWE-364 Description: A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3805 - https
Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3805 - https://access.redhat.com/errata/RHSA-2019:1107 - https://access.redhat.com/errata/RHSA-2019:1108 - https://access.redhat.com/errata/RHSA-2019:1106 - https://access.redhat.com/errata/RHSA-2019:1140 - https://security.netapp.com/advisory/ntap-20190517-0004/ - https://access.redhat.com/errata/RHSA-2019:2413 - https://access.redhat.com/errata/RHSA-2020:0727