Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-14644 State: PUBLISHED Published: 2018-11-09T19:00:00 Last Updated: 2024-08-05T09:38:12.991Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: pdns Problem Types: CWE-20 Description: An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached as failing DNSSEC validation. It only arises if the parent zone is signed, and all the authoritative servers for that parent zone answer with FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC va
FORMERR to a query for at least one of the meta-types. As a result, subsequent queries from clients requesting DNSSEC validation will be answered with a ServFail. Additional Analyst Notes: - CVE Program Container: References: - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-07.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14644
CVE ID: CVE-2018-14645 State: PUBLISHED Published: 2018-09-21T13:00:00 Last Updated: 2024-08-05T09:38:12.812Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: haproxy Problem Types: CWE-125 Description: A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3780-1/ - https://access.redhat.com/errata/RHSA-2018:2882 - https://www.mail-archive.com/haproxy%40formilux.org/msg31253.html - https://bugzilla.redhat.com/show_bu
RHSA-2018:2882 - https://www.mail-archive.com/haproxy%40formilux.org/msg31253.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14645 - https://access.redhat.com/errata/RHBA-2019:0028
CVE ID: CVE-2018-14646 State: PUBLISHED Published: 2018-11-26T19:00:00 Last Updated: 2024-08-05T09:38:13.102Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: kernel: Problem Types: CWE-476 Description: The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3843 - https://access.redhat.com
otes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3843 - https://access.redhat.com/errata/RHSA-2018:3666 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f428fe4a04cc339166c8bbd489789760de3a0cee - https://access.redhat.com/errata/RHSA-2018:3651 - https://marc.info/?l=linux-netdev&m=151500466401174&w=2 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14646
CVE ID: CVE-2018-14647 State: PUBLISHED Published: 2018-09-25T00:00:00 Last Updated: 2024-08-05T09:38:13.104Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: The Python Project Products: Python Problem Types: CWE-665, CWE-335 Description: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 thro
nts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4306 - https://usn.ubuntu.com/3817-2/ - http://www.securitytracker.com/id/1041740 - http://www.securityfocus.com/bid/105396 - https://www.debian.org/security/2018/dsa-4307 - https://bugs.python.org/issue34623 - https://usn.ubuntu.com/3817-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/ - htt
doraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/ - https://access.redhat.com/errata/RHSA-2019:1260 - https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html - https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html - https://access.redhat.com/errata/RHSA-2019:2030 - https://access.redhat.com/errata/RHSA-2019:3725 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2018-14648 State: PUBLISHED Published: 2018-09-28T13:00:00 Last Updated: 2024-08-05T09:38:12.905Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: 389-ds-base: Problem Types: CWE-400 Description: A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/10/msg00015.html - https://access.redhat.com/errata/RHSA-2018:3507 - https://access.redhat.com/errata/
lts-announce/2018/10/msg00015.html - https://access.redhat.com/errata/RHSA-2018:3507 - https://access.redhat.com/errata/RHSA-2018:3127 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14648
CVE ID: CVE-2018-14649 State: PUBLISHED Published: 2018-10-09T17:00:00 Last Updated: 2024-08-05T09:38:13.114Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: ceph-iscsi-cli Problem Types: CWE-77 Description: It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands rem
ges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/articles/3623521 - http://www.securityfocus.com/bid/105434 - https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6b - https://github.com/ceph/ceph-iscsi-cli/issues/120 - https:/
/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6b - https://github.com/ceph/ceph-iscsi-cli/issues/120 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649 - https://access.redhat.com/errata/RHSA-2018:2838 - https://access.redhat.com/errata/RHSA-2018:2837
CVE ID: CVE-2018-14650 State: PUBLISHED Published: 2018-09-27T20:00:00 Last Updated: 2024-08-05T09:38:12.593Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: sos-collector Problem Types: CWE-732 Description: It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sosreport/sos-collector/commit/72058f9253e
onal Analyst Notes: - CVE Program Container: References: - https://github.com/sosreport/sos-collector/commit/72058f9253e7ed8c7243e2ff76a16d97b03d65ed - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14650 - https://access.redhat.com/errata/RHSA-2018:3663
CVE ID: CVE-2018-14651 State: PUBLISHED Published: 2018-10-31T21:00:00 Last Updated: 2024-08-05T09:38:12.621Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: glusterfs Problem Types: CWE-59 Description: It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated attacker could use one of these flaws to execute arbitrary code, create arbitrary files, or cause denial of service on glusterfs server nodes via symlinks to relative paths. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-
. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14651 - https://access.redhat.com/errata/RHSA-2018:3431 - https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html - https://access.redhat.com/errata/RHSA-2018:3432 - https://security.gentoo.org/glsa/201904-06
CVE ID: CVE-2018-14652 State: PUBLISHED Published: 2018-10-31T19:00:00 Last Updated: 2024-08-05T09:38:12.891Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Gluster Project Products: glusterfs Problem Types: CWE-120 Description: The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code handling the 'GF_XATTR_CLRLK_CMD' xattr in the 'pl_getxattr' function. A remote authenticated attacker could exploit this on a mounted volume to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https:
dditional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14652 - https://access.redhat.com/errata/RHSA-2018:3432 - https://access.redhat.com/errata/RHSA-2018:3470 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-14653 State: PUBLISHED Published: 2018-10-31T19:00:00 Last Updated: 2024-08-05T09:38:13.224Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Gluster Project Products: glusterfs Problem Types: CWE-122 Description: The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function via the 'gf_getspec_req' RPC message. A remote authenticated attacker could exploit this to cause a denial of service or other potential unspecified impact. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://bugzilla.redhat
Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14653 - https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html - https://access.redhat.com/errata/RHSA-2018:3432 - https://access.redhat.com/errata/RHSA-2018:3470 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-14654 State: PUBLISHED Published: 2018-10-31T19:00:00 Last Updated: 2024-08-05T09:38:13.005Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: The Gluster Project Products: glusterfs Problem Types: CWE-22 Description: The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GF_XATTROP_ENTRY_IN_KEY' xattrop to create arbitrary, empty files on the target server. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14654 - https://access.redhat.com/errata/RHSA-2
iner: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14654 - https://access.redhat.com/errata/RHSA-2018:3431 - https://access.redhat.com/errata/RHSA-2018:3432 - https://access.redhat.com/errata/RHSA-2018:3470 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-14655 State: PUBLISHED Published: 2018-11-13T19:00:00 Last Updated: 2024-08-05T09:38:13.384Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-79 Description: A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655 - https://access.redhat.com/errata/RHSA-2018:3592 - https://acc
tps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655 - https://access.redhat.com/errata/RHSA-2018:3592 - https://access.redhat.com/errata/RHSA-2018:3593 - https://access.redhat.com/errata/RHSA-2018:3595
CVE ID: CVE-2018-14656 State: PUBLISHED Published: 2018-10-08T22:00:00 Last Updated: 2024-08-05T09:38:12.828Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: kernel Problem Types: CWE-20 Description: A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14656 - http://www.securitytracker.com/id/1041804 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=342db04ae71273322f0011384
com/id/1041804 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=342db04ae71273322f0011384a9ed414df8bdae4 - https://lore.kernel.org/lkml/20180828154901.112726-1-jannh%40google.com/T/ - https://seclists.org/oss-sec/2018/q4/9 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1650
CVE ID: CVE-2018-14657 State: PUBLISHED Published: 2018-11-13T19:00:00 Last Updated: 2024-08-05T09:38:13.017Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-307 Description: A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3592 - https://access.redhat.com/errata/RHSA-2018:3593 - https://access.redhat.com/errata/RHSA-2018:3595 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-
rata/RHSA-2018:3593 - https://access.redhat.com/errata/RHSA-2018:3595 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657
CVE ID: CVE-2018-14658 State: PUBLISHED Published: 2018-11-13T19:00:00 Last Updated: 2024-08-05T09:38:13.033Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-601 Description: A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658 - https://access.redhat.com/errata/RHSA-2018:3592 - https://access.redhat.com/er
dhat.com/show_bug.cgi?id=CVE-2018-14658 - https://access.redhat.com/errata/RHSA-2018:3592 - https://access.redhat.com/errata/RHSA-2018:3593 - https://access.redhat.com/errata/RHSA-2018:3595
CVE ID: CVE-2018-14659 State: PUBLISHED Published: 2018-10-31T19:00:00 Last Updated: 2024-08-05T09:38:13.101Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Gluster Project Products: glusterfs Problem Types: CWE-400 Description: The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A remote, authenticated attacker could exploit this by mounting a Gluster volume and repeatedly calling 'setxattr(2)' to trigger a state dump and create an arbitrary number of files in the server's runtime directory. Additional Analyst Notes: - CVE Program Container: References: -
rary number of files in the server's runtime directory. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html - https://access.redhat.com/errata/RHSA-2018:3432 - https://access.redhat.com/errata/RHSA-2018:3470 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14659 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-14660 State: PUBLISHED Published: 2018-11-01T14:00:00 Last Updated: 2024-08-05T09:38:12.616Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: glusterfs Problem Types: CWE-400 Description: A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker could use this flaw to create multiple locks for single inode by using setxattr repetitively resulting in memory exhaustion of glusterfs server node. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://bugzilla.r
alyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14660 - https://access.redhat.com/errata/RHSA-2018:3432 - https://access.redhat.com/errata/RHSA-2018:3470 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-14661 State: PUBLISHED Published: 2018-10-31T20:00:00 Last Updated: 2024-08-05T09:38:12.978Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Gluster Project Products: glusterfs-server Problem Types: CWE-20 Description: It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://bugzilla.redhat.com/show_bug.cgi
gram Container: References: - https://access.redhat.com/errata/RHSA-2018:3431 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14661 - https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html - https://access.redhat.com/errata/RHSA-2018:3432 - https://access.redhat.com/errata/RHSA-2018:3470 - https://security.gentoo.org/glsa/201904-06 - https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html
CVE ID: CVE-2018-14662 State: PUBLISHED Published: 2019-01-15T21:00:00 Last Updated: 2024-08-05T09:38:12.959Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: ceph Problem Types: CWE-285 Description: It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryption. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00002.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14662 - https://ceph.com/releases/13-2-4-mimic-released - http://lists.opensuse.org/opensuse-secur
w_bug.cgi?id=CVE-2018-14662 - https://ceph.com/releases/13-2-4-mimic-released - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html - https://usn.ubuntu.com/4035-1/ - https://access.redhat.com/errata/RHSA-2019:2538 - https://access.redhat.com/errata/RHSA-2019:2541 - https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html
CVE ID: CVE-2018-14663 State: PUBLISHED Published: 2018-11-26T22:00:00 Last Updated: 2024-08-05T09:38:12.940Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: [UNKNOWN] Products: dnsdist Problem Types: CWE-20 Description: An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not
by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend. Additional Analyst Notes: - CVE Program Container: References: - https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2018-08.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14663
CVE ID: CVE-2018-14664 State: PUBLISHED Published: 2018-10-12T20:00:00 Last Updated: 2024-08-05T09:38:12.688Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: foreman Problem Types: CWE-79 Description: A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14664 - https://pr
st Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14664 - https://projects.theforeman.org/issues/25169 - http://www.securityfocus.com/bid/106553 - https://access.redhat.com/errata/RHSA-2019:1222
CVE ID: CVE-2018-14665 State: PUBLISHED Published: 2018-10-25T20:00:00 Last Updated: 2024-08-05T09:38:13.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45742/ - https://lists.x.org/archives/xorg-announce/2018-October/002927.html - https://www.exploit-db.com/exploits/45922