Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-1828 State: PUBLISHED Published: 2017-10-06T22:00:00 Last Updated: 2024-08-06T04:54:16.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack. Additional Analyst Notes: - CVE Program Container: References: - https://rubysec.com/advisories/http-CVE-2015-1828 - https://github.com/ruby/openssl/issues/8 - https://groups.google.com/forum/#%21topic/httprb/jkb4oxwZjkU
CVE ID: CVE-2015-1829 State: PUBLISHED Published: 2015-10-21T21:00:00 Last Updated: 2024-08-06T04:54:16.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html - http://www.apache.org/dist/apr/Announcement1.x.html - http://www.securitytracker.com/id/1032617 - http://www.securityfocus.com/bid/75164
CVE ID: CVE-2015-1830 State: PUBLISHED Published: 2015-08-19T15:00:00 Last Updated: 2024-08-06T04:54:16.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt - http://www.securityfocus.com/bid/76452 - http://www.zerodayinitiative.com/advisories/ZDI-15-407 - http://www.zerodayinitiative.com/advisori
focus.com/bid/76452 - http://www.zerodayinitiative.com/advisories/ZDI-15-407 - http://www.zerodayinitiative.com/advisories/ZDI-15-407/ - http://www.securitytracker.com/id/1033315 - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - http://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.html
CVE ID: CVE-2015-1831 State: PUBLISHED Published: 2015-07-16T14:00:00 Last Updated: 2024-08-06T04:54:16.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://struts.apache.org/docs/s2-024.html - http://www.securityfocus.com/bid/75940 - http://www.securitytracker.com/id/1032985
CVE ID: CVE-2015-1832 State: PUBLISHED Published: 2016-10-03T21:00:00 Last Updated: 2024-08-06T04:54:16.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93132 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apach
ttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - h
ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://issues.apache.org/jira/browse/DERBY-6807 - http://www-01.ibm.com/support/docview.wss?uid=swg21990100 - https://svn.apache.org/viewvc?view=revision&revision=1691461
CVE ID: CVE-2015-1833 State: PUBLISHED Published: 2015-05-29T15:00:00 Last Updated: 2024-08-06T04:54:16.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3298 - http://www.securityfocus.com/bid/74761 - https://www.exploit-db.com/exploits/37110/ - http://mail-archives.apache.org/mod_m
p://www.securityfocus.com/bid/74761 - https://www.exploit-db.com/exploits/37110/ - http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E - http://www.securityfocus.com/archive/1/535582/100/0/threaded - http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt - https://issues.apache.org/jira/browse/JCR-3883 - http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html
CVE ID: CVE-2015-1834 State: PUBLISHED Published: 2017-05-25T17:00:00 Last Updated: 2024-08-06T04:54:16.330Z Vendors: Pivotal Products: Cloud Foundry Problem Types: Path Traversal Description: A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain
he web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2015-1834 - http://www.securityfocus.com/bid/98691
CVE ID: CVE-2015-1835 State: PUBLISHED Published: 2017-10-27T19:00:00 Last Updated: 2024-08-06T04:54:16.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74866 - http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/ - https://cordova.apache.org/an
micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/ - https://cordova.apache.org/announcements/2015/05/26/android-402.html
CVE ID: CVE-2015-1836 State: PUBLISHED Published: 2015-12-21T11:00:00 Last Updated: 2024-08-06T04:54:16.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=_CFiTfQ2d0V+kuJx_y5iz
ontainer: References: - http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=_CFiTfQ2d0V+kuJx_y5izmYccaKjXaJ3V72KK7tbOhbkg%40mail.gmail.com%3E - http://www-01.ibm.com/support/docview.wss?uid=swg21969546 - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html - http://www.securitytracker.com/id/1034365
CVE ID: CVE-2015-1837 State: REJECTED Published: 2022-07-08T17:36:05 Last Updated: 2022-07-08T17:36:05 Description: No description available.
CVE ID: CVE-2015-1838 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T04:54:16.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html - https://bugzilla.redhat.com/show_bug.cgi?id=1212784 - https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c - https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html
CVE ID: CVE-2015-1839 State: PUBLISHED Published: 2017-04-13T14:00:00 Last Updated: 2024-08-06T04:54:16.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81 - https://bugzilla.redhat.com/show_bug.cgi?id=1212788 - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html - https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5c - https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html
CVE ID: CVE-2015-1840 State: PUBLISHED Published: 2015-07-26T22:00:00 Last Updated: 2024-08-06T04:54:16.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html - http://lists.opensuse.org/opensuse-updates
://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html - http://lists.opensuse.org/opensuse-updates/2015-07/msg00041.html - http://openwall.com/lists/oss-security/2015/06/16/15 - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html - https://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J - http://www.securityfocus.com/bid/75239 - https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md
CVE ID: CVE-2015-1841 State: PUBLISHED Published: 2015-09-08T15:00:00 Last Updated: 2024-08-06T04:54:16.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033459 - http://rhn.redhat.com/errata/RHSA-2015-1713.html
CVE ID: CVE-2015-1842 State: PUBLISHED Published: 2015-04-10T14:00:00 Last Updated: 2024-08-06T04:54:16.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0791.html - https://bugzilla.redhat.com/show_bug.cgi?id=1201875 - http://www.securityfocus.com/bid/74049 - http://rhn.redhat.com/errata/RHSA-2015-0831.html - http://rhn.redhat.com/errata/RHSA-
/www.securityfocus.com/bid/74049 - http://rhn.redhat.com/errata/RHSA-2015-0831.html - http://rhn.redhat.com/errata/RHSA-2015-0832.html - http://rhn.redhat.com/errata/RHSA-2015-0789.html - http://rhn.redhat.com/errata/RHSA-2015-0830.html
CVE ID: CVE-2015-1843 State: PUBLISHED Published: 2015-04-06T15:00:00 Last Updated: 2024-08-06T04:54:16.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-077
regression. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0776.html - https://bugzilla.redhat.com/show_bug.cgi?id=1206443 - http://www.securityfocus.com/bid/73936
CVE ID: CVE-2015-1844 State: PUBLISHED Published: 2015-08-14T18:00:00 Last Updated: 2024-08-06T04:54:16.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2015:1592 - http://projects.theforeman.org/issues/9947 - https://groups.google.com/forum/#%21topic/foreman-users/qAGZh5n6n6M - https://access.redhat.com/errata/RHSA-2015:1591 - https://github.com/theforeman/foreman/pull/2273 - https://groups.google.com/forum/#%21topic/foreman-announce/37K
:1591 - https://github.com/theforeman/foreman/pull/2273 - https://groups.google.com/forum/#%21topic/foreman-announce/37KYWhIk4FY
CVE ID: CVE-2015-1845 State: PUBLISHED Published: 2015-05-19T18:00:00 Last Updated: 2024-08-06T04:54:16.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/73693 - http://www.securitytracker.com/id/1032011 - https://bugzilla.redhat.com/show_bug.cgi?id=1207645 - http://www.openwall.com/lists/oss-security/2015/04/01/5
CVE ID: CVE-2015-1846 State: PUBLISHED Published: 2015-05-19T18:00:00 Last Updated: 2024-08-06T04:54:16.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032011 - https://bugzilla.redhat.com/show_bug.cgi?id=1207647 - http://www.securityfocus.com/bid/73686 - http://www.openwall.com/lists/oss-security/2015/04/01/5
CVE ID: CVE-2015-1847 State: PUBLISHED Published: 2017-07-24T15:00:00 Last Updated: 2024-08-06T04:54:16.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. (dot dot) in a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://appserver.io/security/2015/03/31/traversal-directory-vulnerability-in-webserver.html
CVE ID: CVE-2015-1848 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T04:54:16.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0990.html - http://lists.fedoraproject.org/pipermail
ram Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0990.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html - https://bugzilla.redhat.com/attachment.cgi?id=1009855 - http://rhn.redhat.com/errata/RHSA-2015-0980.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html - http://www.securityfocus.com/bid/74623
CVE ID: CVE-2015-1849 State: PUBLISHED Published: 2017-09-19T17:00:00 Last Updated: 2024-08-06T04:54:16.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wildfly-security/jboss-negotiation/pull/21 - https://bugzilla.redhat.com/show_bug.cgi?id=1208580 - https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e - https://b
8580 - https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e - https://bugzilla.redhat.com/show_bug.cgi?id=1199641
CVE ID: CVE-2015-1850 State: REJECTED Published: 2020-01-15T14:24:26.354Z Last Updated: 2025-02-13T15:46:10.300Z Description: No description available.
CVE ID: CVE-2015-1851 State: PUBLISHED Published: 2015-06-25T16:00:00 Last Updated: 2024-08-06T04:54:16.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command. Additional Analyst Notes: - CVE Program Container: References: - http://lists.openstack.org/pipermail/openstack-announce/2015-June/000367.html - http://www.debian.org/security/2015/dsa-3292 - http://www.openwall.com/lists/oss-security/2015/06/13/1 - http://www.openwall.com/lists/oss-se
/security/2015/dsa-3292 - http://www.openwall.com/lists/oss-security/2015/06/13/1 - http://www.openwall.com/lists/oss-security/2015/06/17/7 - http://rhn.redhat.com/errata/RHSA-2015-1206.html - http://www.ubuntu.com/usn/USN-2703-1 - http://www.openwall.com/lists/oss-security/2015/06/17/2 - https://bugs.launchpad.net/cinder/+bug/1415087
CVE ID: CVE-2015-1852 State: PUBLISHED Published: 2015-04-17T17:00:00 Last Updated: 2024-08-06T04:54:16.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2705-1 - http://lists.openstack.org/pipermail/openst
CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2705-1 - http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html - https://bugs.launchpad.net/keystonemiddleware/+bug/1411063 - http://rhn.redhat.com/errata/RHSA-2015-1685.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - http://www.securityfocus.com/bid/74187 - http://rhn.redhat.com/errata/RHSA-2015-1677.html
CVE ID: CVE-2015-1853 State: PUBLISHED Published: 2019-12-09T18:53:22 Last Updated: 2024-08-06T04:54:16.335Z Vendors: chrony Products: chrony Problem Types: Other Description: chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201507-01 - http://chrony.tuxfamily.org/News.html
CVE ID: CVE-2015-1854 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T04:54:16.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74392 - https://access.redhat.com/errata/RHSA-2015:0895 - https://bugzilla.redhat.com/show_bug.cgi?id=1209573 - https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157069.html
CVE ID: CVE-2015-1855 State: PUBLISHED Published: 2019-11-29T20:46:48 Last Updated: 2024-08-06T04:54:16.307Z Vendors: Ruby Products: Ruby Problem Types: Other Description: verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3247 - http://www.debian.org/security/2015/dsa-3245 - http://www.debian.org/s
- http://www.debian.org/security/2015/dsa-3247 - http://www.debian.org/security/2015/dsa-3245 - http://www.debian.org/security/2015/dsa-3246 - https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/ - https://puppetlabs.com/security/cve/cve-2015-1855 - https://bugs.ruby-lang.org/issues/9644
CVE ID: CVE-2015-1856 State: PUBLISHED Published: 2015-04-17T17:00:00 Last Updated: 2024-08-06T04:54:16.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1845.html - https://bugs.launchpad.net/swift/+bug/1430645 - http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00025.html - http://rhn.redhat.com/errata/RHSA-2015-1846.html - http://rhn.redha