Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-14370 State: PUBLISHED Published: 2018-07-19T02:00:00 Last Updated: 2024-08-05T09:29:51.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2018-43.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 - http://www.securitytracker.com/id/1041608 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b1446124eebc3ea5591d18e719c2a5cff3630
/1041608 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b1446124eebc3ea5591d18e719c2a5cff3630638 - http://www.securityfocus.com/bid/104847 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2018-14371 State: PUBLISHED Published: 2018-07-18T12:00:00 Last Updated: 2024-08-05T09:29:51.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/javaserverfaces/mojarra/issues/4364 - https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
CVE ID: CVE-2018-14373 State: REJECTED Published: 2018-07-17T23:00:00 Last Updated: 2018-08-08T14:57:01 Description: No description available.
CVE ID: CVE-2018-14374 State: REJECTED Published: 2018-07-17T23:00:00 Last Updated: 2018-08-08T14:57:01 Description: No description available.
CVE ID: CVE-2018-14375 State: REJECTED Published: 2018-07-17T23:00:00 Last Updated: 2018-08-08T14:57:01 Description: No description available.
CVE ID: CVE-2018-14378 State: REJECTED Published: 2018-07-17T23:00:00 Last Updated: 2018-08-08T14:57:01 Description: No description available.
CVE ID: CVE-2018-14379 State: PUBLISHED Published: 2018-07-18T00:00:00 Last Updated: 2024-08-05T09:29:51.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file, because access to the data structure has different expectations about layout as a result of this type confusion. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/07/17/1 - https://lis
lyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/07/17/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRSO2IMK6P7MOIZWGWKONPIEHKBA7WL3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GISUIWPKBWPXORUFNWBGFTKQS7UUVUC4/ - https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0
CVE ID: CVE-2018-14380 State: PUBLISHED Published: 2018-07-18T15:00:00 Last Updated: 2024-08-05T09:29:51.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Graylog2/graylog2-server/pull/4904 - https://www.graylog.org/post/announcing-the-release-of-graylog-2-4-6
CVE ID: CVE-2018-14381 State: PUBLISHED Published: 2018-07-18T15:00:00 Last Updated: 2024-08-05T09:29:50.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pagekit/pagekit/issues/905 - https://github.com/pagekit/pagekit/releases/tag/1.0.14
CVE ID: CVE-2018-14382 State: PUBLISHED Published: 2018-07-18T15:00:00 Last Updated: 2024-08-05T09:29:51.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: InstantCMS 2.10.1 has /redirect?url= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/instantsoft/icms2/issues/892
CVE ID: CVE-2018-14383 State: PUBLISHED Published: 2019-08-07T14:14:37 Last Updated: 2024-08-05T09:29:51.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7 Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/37456/the-scheduler?hosting=server&tab=versions - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-022_jira_plugin_the_scheduler.txt
CVE ID: CVE-2018-14384 State: PUBLISHED Published: 2020-03-02T16:32:40 Last Updated: 2024-08-05T09:29:50.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-005
CVE ID: CVE-2018-14387 State: PUBLISHED Published: 2018-07-18T19:00:00Z Last Updated: 2024-09-16T18:03:27.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the server using the same session identifier. The attacker can access the user's account through the active session. The Session Fixation attack fixes a session on the victim's browser, so the attack starts before the user logs in. Additional Analyst Notes: - CVE Program Container: References: - https://github.com
tack starts before the user logs in. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/robiso/wondercms/issues/64 - https://www.wondercms.com/whatsnew
CVE ID: CVE-2018-14388 State: PUBLISHED Published: 2018-07-18T19:00:00Z Last Updated: 2024-09-16T23:25:34.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/429
CVE ID: CVE-2018-14389 State: PUBLISHED Published: 2018-07-18T19:00:00Z Last Updated: 2024-09-16T19:40:13.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/430
CVE ID: CVE-2018-14392 State: PUBLISHED Published: 2018-07-19T02:00:00 Last Updated: 2024-08-05T09:29:51.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: The New Threads plugin before 1.2 for MyBB has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45057/ - https://community.mybb.com/mods.php?action=changelog&pid=1143
CVE ID: CVE-2018-14394 State: PUBLISHED Published: 2018-07-19T05:00:00 Last Updated: 2024-08-05T09:29:50.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/3a2d21bc5f97aa0161db3ae731fc2732be6108b8 - https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
CVE ID: CVE-2018-14395 State: PUBLISHED Published: 2018-07-19T05:00:00 Last Updated: 2024-08-05T09:29:51.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: libavformat/movenc.c in FFmpeg 3.2 and 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted audio file when converting to the MOV audio format. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4258 - http://www.securitytracker.com/id/1041394 - https://github.com/FFmpeg/FFmpeg/commit/fa19fbcf712a6a6cc5a5cfdc3254a97b9bce6582 - https://github.com/FFmpeg/FFmpeg/commit/2c0e98a0b478284bdff6d7a4062522605a8
t/fa19fbcf712a6a6cc5a5cfdc3254a97b9bce6582 - https://github.com/FFmpeg/FFmpeg/commit/2c0e98a0b478284bdff6d7a4062522605a8beae5
CVE ID: CVE-2018-14396 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T09:29:51.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilitie
s: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE ID: CVE-2018-14397 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T09:29:51.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE ID: CVE-2018-14398 State: PUBLISHED Published: 2018-09-07T22:00:00 Last Updated: 2024-08-05T09:29:51.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Creme CRM 1.6.12. The value of the cancel button uses the content of the HTTP Referer header, and could be used to trick a user into visiting a fake login page in order to steal credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.bishopfox.com/news/2018/08/cremecrm-1-6-12-multiple-vulnerabilities/
CVE ID: CVE-2018-14399 State: PUBLISHED Published: 2018-07-19T05:00:00 Last Updated: 2024-08-05T09:29:51.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element within info[content] JSON data to the index.php?m=member&c=index&a=register URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.an-sheng.cc/index.php/archives/4/
CVE ID: CVE-2018-14400 State: REJECTED Published: 2018-08-28T19:00:00 Last Updated: 2018-09-06T19:57:01 Description: No description available.
CVE ID: CVE-2018-14401 State: PUBLISHED Published: 2018-07-19T05:00:00 Last Updated: 2024-08-05T09:29:51.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jjanier/axml/issues/1
CVE ID: CVE-2018-14402 State: PUBLISHED Published: 2018-07-19T05:00:00 Last Updated: 2024-08-05T09:29:51.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: axmldec 1.2.0 has an out-of-bounds write in the jitana::axml_parser::parse_start_namespace function in lib/jitana/util/axml_parser.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ytsutano/axmldec/issues/4
CVE ID: CVE-2018-14403 State: PUBLISHED Published: 2018-07-19T00:00:00 Last Updated: 2024-08-05T09:29:50.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2018/07/18/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/ - https://lists.fedoraproject.org/archives/list/package
ists.fedoraproject.org/message/6YCHVOYPIBGM5HYUMQ77KZH2IHSITKVE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRSO2IMK6P7MOIZWGWKONPIEHKBA7WL3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GISUIWPKBWPXORUFNWBGFTKQS7UUVUC4/ - https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0
CVE ID: CVE-2018-14404 State: PUBLISHED Published: 2018-07-19T13:00:00 Last Updated: 2024-08-05T09:29:51.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html - https://gitlab.gnome.org/G
Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html - https://gitlab.gnome.org/GNOME/libxml2/issues/10 - https://usn.ubuntu.com/3739-1/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817 - https://usn.ubuntu.com/3739-2/ - https://bugzilla.redhat.com/show_bug.cgi?id=1595985 - https://access.redhat.com/errata/RHSA-2019:1543 - https://security.netapp.com/advisory/ntap-20190719-0002/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html
CVE ID: CVE-2018-14415 State: PUBLISHED Published: 2018-07-19T18:00:00 Last Updated: 2024-08-05T09:29:51.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/28
CVE ID: CVE-2018-14417 State: PUBLISHED Published: 2018-08-03T16:00:00 Last Updated: 2024-08-05T09:29:50.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104914 - https://www.exploit-db.com/exploits/45097/ - https://www.coresecurity.com/advisories/softnas-cloud-os-command-injection
https://www.exploit-db.com/exploits/45097/ - https://www.coresecurity.com/advisories/softnas-cloud-os-command-injection - https://docs.softnas.com/display/SD/Release+Notes - http://seclists.org/fulldisclosure/2018/Jul/85
CVE ID: CVE-2018-14418 State: PUBLISHED Published: 2018-07-19T18:00:00 Last Updated: 2024-08-05T09:29:50.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.wtfsec.org/2583/msvod-v10-sql-injection/ - https://www.exploit-db.com/exploits/45062/
CVE ID: CVE-2018-14419 State: PUBLISHED Published: 2018-07-19T18:00:00 Last Updated: 2024-08-05T09:29:51.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/Metinfo---XSS/blob/master/test
CVE ID: CVE-2018-14420 State: PUBLISHED Published: 2018-07-19T18:00:00 Last Updated: 2024-08-05T09:29:51.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=admin_admin&a=doaddsave URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AvaterXXX/Metinfo---XSS/blob/master/CSRF
CVE ID: CVE-2018-14421 State: PUBLISHED Published: 2018-07-19T18:00:00 Last Updated: 2024-08-05T09:29:50.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v&#95;pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF. Additional Analyst Notes: - CVE Program Container: References: - http://hexo.imagemlt.xyz/post/seacms-backend-getshell/index.html
CVE ID: CVE-2018-14422 State: PUBLISHED Published: 2018-07-19T18:00:00 Last Updated: 2024-08-05T09:29:51.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: blog/index.php in SansCMS 0.7 has XSS via the q parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thm/SansCMS/issues/7
CVE ID: CVE-2018-14423 State: PUBLISHED Published: 2018-07-19T19:00:00 Last Updated: 2024-08-05T09:29:51.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00013.html - https://github.com/uclouvain/openjpeg/issues/1123 - https://www.debian.org/security/2019/dsa-4405 - https://usn.ubuntu.com/4109-1/
CVE ID: CVE-2018-14424 State: PUBLISHED Published: 2018-08-14T16:00:00 Last Updated: 2024-08-05T09:29:51.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00003.html - https://gitlab.gnome.org/GNOME/gdm/issues/401 - https://usn.ubuntu.com/3737-1/ - https://www.de
/2018/09/msg00003.html - https://gitlab.gnome.org/GNOME/gdm/issues/401 - https://usn.ubuntu.com/3737-1/ - https://www.debian.org/security/2018/dsa-4270 - http://www.securityfocus.com/bid/105179
CVE ID: CVE-2018-14425 State: PUBLISHED Published: 2019-05-30T17:07:11 Last Updated: 2024-08-05T09:29:51.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://bugzilla.zimbra.com/show_bug.cgi?id=108970
CVE ID: CVE-2018-14429 State: PUBLISHED Published: 2018-08-14T16:00:00 Last Updated: 2024-08-05T09:29:50.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.securityfocus.com/archive/1/542208/100/0/threaded - http://packetstormsecurity.com/files/148855/man-cgi-Local-File-Inclusion.html
CVE ID: CVE-2018-14430 State: PUBLISHED Published: 2018-07-25T23:00:00 Last Updated: 2024-08-05T09:29:51.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data [id][1], fw_data [id][2], fw_data [id][3], fw_data [id][4], or email field of the contact form, exploitable with an fw_send_email action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2018-14430-wordpress-plugin-multi-step-form-125-multiples-xss-reflejados/ - https://wpvulndb.com/vulnerabilities/9106
CVE ID: CVE-2018-14432 State: PUBLISHED Published: 2018-07-31T14:00:00 Last Updated: 2024-08-05T09:29:51.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHS
.json is affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2543 - https://access.redhat.com/errata/RHSA-2018:2533 - http://www.openwall.com/lists/oss-security/2018/07/25/2 - https://access.redhat.com/errata/RHSA-2018:2523 - http://www.securityfocus.com/bid/104930 - https://www.debian.org/security/2018/dsa-4275
CVE ID: CVE-2018-14434 State: PUBLISHED Published: 2018-07-20T00:00:00 Last Updated: 2024-08-05T09:29:51.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3785-1/ - https://github.com/ImageMagick/ImageMagick/issues/1192 - https://usn.ubuntu.com/4034-1/
CVE ID: CVE-2018-14435 State: PUBLISHED Published: 2018-07-20T00:00:00 Last Updated: 2024-08-05T09:29:51.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1193 - https://usn.ubuntu.com/3785-1/
CVE ID: CVE-2018-14436 State: PUBLISHED Published: 2018-07-20T00:00:00 Last Updated: 2024-08-05T09:29:51.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1191 - https://usn.ubuntu.com/3785-1/
CVE ID: CVE-2018-14437 State: PUBLISHED Published: 2018-07-20T00:00:00 Last Updated: 2024-08-05T09:29:50.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1190 - https://usn.ubuntu.com/3785-1/