Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l.haxx.se/docs/adv_20150422A.html - http://www.debian.org/security/2015/dsa-3232 - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:219 - http://www.ubuntu.com/usn/USN-2591-1 - http://www.securitytracker.com/id/1032232 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://www.securityfocus.com/bid/74299 - http://rhn.redhat.com/errata/RHSA-2015-1254.html - http://www.mandriva.com/security/advisories?name=MD
s.com/bid/74299 - http://rhn.redhat.com/errata/RHSA-2015-1254.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:220 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html - http://advisories.mageia.org/MGASA-2015-0179.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 - https://support.apple.com/kb/HT205031 - https://security.gentoo.org/glsa/201509-02 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html - http://lists.fedoraproject.org/pipermail
p://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html
CVE ID: CVE-2015-3144 State: PUBLISHED Published: 2015-04-24T14:00:00 Last Updated: 2024-08-06T05:39:31.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80." Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html - http://www.oracle.com/technetwork/topics/security/cpuoct2015-236795
rg/pipermail/package-announce/2015-May/157188.html - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html - http://www.debian.org/security/2015/dsa-3232 - http://www.securityfocus.com/bid/74300 - http://www.ubuntu.com/usn/USN-2591-1 - http://www.securitytracker.com/id/1032232 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html - https://support.apple.com/kb/HT20
2016-2867206.html - http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html - https://support.apple.com/kb/HT205031 - https://security.gentoo.org/glsa/201509-02 - http://curl.haxx.se/docs/adv_20150422D.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html
CVE ID: CVE-2015-3145 State: PUBLISHED Published: 2015-04-24T14:00:00 Last Updated: 2024-08-06T05:39:30.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74303 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html - http://www.debian.org/security/2015/ds
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html - http://www.debian.org/security/2015/dsa-3232 - http://curl.haxx.se/docs/adv_20150422C.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:219 - http://www.ubuntu.com/usn/USN-2591-1 - http://www.securitytracker.com/id/1032232 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.
t/InfoCenter/index?page=content&id=JSA10743 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html - http://advisories.mageia.org/MGASA-2015-0179.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 - https://support.apple.com/kb/HT205031 - https://security.gentoo.org/glsa/201509-02 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html
CVE ID: CVE-2015-3146 State: PUBLISHED Published: 2016-04-13T17:00:00 Last Updated: 2024-08-06T05:39:32.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted SSH packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2912-1 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161802.html - https://www.libssh.org/security/advisories/CVE-2015-3146.txt - http://lists.fedorapro
e-announce/2015-July/161802.html - https://www.libssh.org/security/advisories/CVE-2015-3146.txt - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158013.html - https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/ - http://www.debian.org/security/2016/dsa-3488 - https://git.libssh.org/projects/libssh.git/commit/?h=libssh-0.6.5&id=94f6955fbaee6fda9385a23e505497efe21f5b4f
CVE ID: CVE-2015-3147 State: PUBLISHED Published: 2020-01-14T17:31:49 Last Updated: 2024-08-06T05:39:31.852Z Vendors: ABRT Products: ABRT Problem Types: Symbolic Link Following Description: daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/17/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1212953 - https://github.com/abrt/abrt/pull/955 - http://rhn.r
015/04/17/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1212953 - https://github.com/abrt/abrt/pull/955 - http://rhn.redhat.com/errata/RHSA-2015-1083.html - https://github.com/abrt/abrt/commit/3746b7627218438ae7d781fc8b18a221454e9091
CVE ID: CVE-2015-3148 State: PUBLISHED Published: 2015-04-24T14:00:00 Last Updated: 2024-08-06T05:39:31.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=145612005512270&w=2 - http://curl.haxx.se/docs/adv_20150422B.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html - http://www.debian.org/security/2015/dsa-3232 - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/15
- http://www.debian.org/security/2015/dsa-3232 - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html - http://www.securityfocus.com/bid/74301 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:219 - http://www.ubuntu.com/usn/USN-2591-1 - http://www.securitytracker.com/id/1032232 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://rhn.redhat.com/errata/RHSA-2015-1254.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:220 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://www.oracle.com/technetwork/
me=MDVSA-2015:220 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html - http://advisories.mageia.org/MGASA-2015-0179.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 - https://support.apple.com/kb/HT205031 - https://security.gentoo.org/glsa/201509-02 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.
ail/package-announce/2015-April/155957.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html
CVE ID: CVE-2015-3149 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-06T05:39:31.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/75933 - https://bugzilla.redhat.com/show_bug.cgi?id=1213365 - http://rhn.redhat.com/errata/RHSA-2015-1228.html
CVE ID: CVE-2015-3150 State: PUBLISHED Published: 2020-01-14T17:34:43 Last Updated: 2024-08-06T05:39:31.644Z Vendors: ABRT Products: ABRT Problem Types: Other Description: abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1214457 - https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8 - https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1 - https://github.com/
181f5b133af32ce62d8 - https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1 - https://github.com/abrt/abrt/commit/b7f8bd20b7fb5b72f003ae3fa647c1d75f4218b7 - https://github.com/abrt/libreport/commit/1951e7282043dfe1268d492aea056b554baedb75
CVE ID: CVE-2015-3151 State: PUBLISHED Published: 2020-01-14T17:47:12 Last Updated: 2024-08-06T05:39:31.509Z Vendors: ABRT Products: ABRT Problem Types: Directory Traversal (Local File Inclusion) Description: Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3151 - https://github.com/abrt/abrt/commit/c796c76341ee846cfb897ed645bac211d7d0a932 - https://github.com/
gi?id=CVE-2015-3151 - https://github.com/abrt/abrt/commit/c796c76341ee846cfb897ed645bac211d7d0a932 - https://github.com/abrt/abrt/commit/f3c2a6af3455b2882e28570e8a04f1c2d4500d5b - https://github.com/abrt/libreport/commit/54ecf8d017580b495d6501e53ca54e453a73a364 - https://github.com/abrt/libreport/commit/239c4f7d1f47265526b39ad70106767d00805277 - https://github.com/abrt/abrt/commit/7a47f57975be0d285a2f20758e4572dca6d9cdd3
CVE ID: CVE-2015-3152 State: PUBLISHED Published: 2016-05-16T10:00:00 Last Updated: 2024-08-06T05:39:32.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131688/MySQL-SSL-TLS-Downgrade.html - http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/ - http://www.securityfocus.c
de.html - http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/ - http://www.securityfocus.com/bid/74398 - https://github.com/mysql/mysql-server/commit/3bd5589e1a5a93f9c224badf983cd65c45215390 - https://access.redhat.com/security/cve/cve-2015-3152 - http://rhn.redhat.com/errata/RHSA-2015-1646.html - http://www.debian.org/security/2015/dsa-3311 - http://mysqlblog.fivefarmers.com/2014/04/02/redefining-ssl-option/ - http://rhn.redhat.com/errata/RHSA-2015-1647.html - http://www.securitytracker.com/id/1032216 - https://www.duosecurity.com/blog/backronym-mysql-vulnerability - https://jira.mariadb.org/browse/MDEV-7937 - http://www.ocert.org/advisories/ocert-2015-003.html
ym-mysql-vulnerability - https://jira.mariadb.org/browse/MDEV-7937 - http://www.ocert.org/advisories/ocert-2015-003.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161625.html - http://www.securityfocus.com/archive/1/535397/100/1100/threaded - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161436.html - http://rhn.redhat.com/errata/RHSA-2015-1665.html
CVE ID: CVE-2015-3153 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:39:31.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10131 - http://www.securitytracker.com/id/1032233 - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html - http://www.oracle.com/technetwork/topics/security/c
www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - http://www.ubuntu.com/usn/USN-2591-1 - http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - https://support.apple.com/kb/HT205031 - http://www.securityfocus.com/bid/74408 - http://curl.haxx.se/docs/adv_20150429.html - http://www.debian.org/s
HT205031 - http://www.securityfocus.com/bid/74408 - http://curl.haxx.se/docs/adv_20150429.html - http://www.debian.org/security/2015/dsa-3240
CVE ID: CVE-2015-3154 State: PUBLISHED Published: 2020-01-27T15:02:12 Last Updated: 2024-08-06T05:39:31.844Z Vendors: Zend Technologies Products: Zend Framework Problem Types: CRLF Injection Description: CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email. Additional Analyst Notes: - CVE Program Container: References: - http://framework.zend.com/security/advisory/ZF2015-04
CVE ID: CVE-2015-3155 State: PUBLISHED Published: 2015-08-14T18:00:00 Last Updated: 2024-08-06T05:39:31.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Additional Analyst Notes: - CVE Program Container: References: - http://projects.theforeman.org/issues/10275 - https://access.redhat.com/errata/RHSA-2015:1592 - https://bugzilla.redhat.com/show_bug.cgi?id=1216035 - https://groups.google.com/forum/#%21topic/foreman-announce/QPtN0h04jdo - https://access.redhat.c
ow_bug.cgi?id=1216035 - https://groups.google.com/forum/#%21topic/foreman-announce/QPtN0h04jdo - https://access.redhat.com/errata/RHSA-2015:1591 - https://github.com/theforeman/foreman/pull/2328
CVE ID: CVE-2015-3156 State: PUBLISHED Published: 2017-08-11T21:00:00 Last Updated: 2024-08-06T05:39:31.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in
restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary fil
ck before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/mysql/service.py#L790 - https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysql_impl.py#L110 - https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/service.py#L230 - https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysql_impl.py#L55 - https://bugs.launchpad.net/trove/+bug/1398195 - https://github.com/openstack/trove/blob/master
ackup/mysql_impl.py#L55 - https://bugs.launchpad.net/trove/+bug/1398195 - https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/experimental/couchbase_impl.py#L30 - https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/mongodb/service.py#L176 - https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysql_impl.py#L36 - https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/restore/mysql_impl.py#L194 - https://bugzilla.redhat.com/show_bug.cgi?id=1216073 - https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/redis/service.py#L236
CVE ID: CVE-2015-3157 State: REJECTED Published: 2015-07-02T14:42:00 Last Updated: 2015-07-02T14:57:02 Description: No description available.
CVE ID: CVE-2015-3158 State: PUBLISHED Published: 2015-08-26T19:00:00 Last Updated: 2024-08-06T05:39:31.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1671.html - http://rhn.redhat.com/errata/RHSA-2015-1672.html - http://rhn.redhat.com/errat
n.redhat.com/errata/RHSA-2015-1671.html - http://rhn.redhat.com/errata/RHSA-2015-1672.html - http://rhn.redhat.com/errata/RHSA-2015-1673.html - http://rhn.redhat.com/errata/RHSA-2015-1670.html - https://github.com/picketlink/picketlink-bindings/pull/124 - https://issues.jboss.org/browse/PLINK-708 - http://rhn.redhat.com/errata/RHSA-2015-1669.html - https://bugzilla.redhat.com/show_bug.cgi?id=1216123
CVE ID: CVE-2015-3159 State: PUBLISHED Published: 2020-01-14T18:00:14 Last Updated: 2024-08-06T05:39:31.666Z Vendors: ABRT Products: ABRT Problem Types: Privilege Description: The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1216962 - https://github.com/abrt/abrt/commit/9943a77bca37a0829ccd3784d1dfab37f8c24e7b - https://github.com/abrt/abrt/commit/9a4100678fea4d60ec93d35f4c5de2e9ad054f3a
CVE ID: CVE-2015-3160 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:39:32.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/05/08/1 - https://bugzilla.redhat.com/show_bug.cgi?id=1215020 - https://bugzilla.redhat.com/attachment.cgi?id=1020003 - https://beaker-project.
lla.redhat.com/show_bug.cgi?id=1215020 - https://bugzilla.redhat.com/attachment.cgi?id=1020003 - https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1 - http://www.securityfocus.com/bid/74569
CVE ID: CVE-2015-3161 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:39:31.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/attachment.cgi?id=1020004 - http://www.openwall.com/lists/oss-security/2015/05/08/1 - http://www.securityfocus.com/bid/74574 - https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html - https://bugzilla.redhat.com/show_bug.cgi?id=121
ew-checks-docs/995/documentation/_build/html/whats-new/release-20.html - https://bugzilla.redhat.com/show_bug.cgi?id=1215024
CVE ID: CVE-2015-3162 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:39:31.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated users to inject arbitrary web script or HTML via writing a crafted comment on an acked or nacked canceled job. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/05/08/1 - http://www.securityfocus.com/bid/74568 - https://bugzilla.redhat.com/show_bug.cgi?id=1215030 - https://bugzilla.redhat.com/attachment.cgi?id=1021565 - https://bea