Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ocDisplay?docId=emr_na-c05390722 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - https://access.redhat.com/errata/RHSA-2016:1422 - http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html - https://access.redhat.com/errata/RHSA-2016:1421 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/ - http://rhn.redhat.com/errata/RHSA-2016-1650.html - http://rhn.redhat.com/errata/RHSA-2016-1624.html - https://www.apache.org/security/asf-httpoxy-response.txt - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/
ity/asf-httpoxy-response.txt - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/ - https://httpoxy.org/ - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - https://security.gentoo.org/glsa/201701-36 - https://access.redhat.com/errata/RHSA-2016:1636 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/ - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e8
g/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/ - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thr
ml/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.
apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42
5f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - http
sts.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2016-5388 State: PUBLISHED Published: 2016-07-19T01:00:00 Last Updated: 2024-08-06T01:00:59.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-201
a an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:1635 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759 - http://www.kb.cert.org/vuls/id/797896 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html - http://rhn.redhat.com/errata/RHSA-2016-2045.html - http://rhn.redhat.com/errata/RHSA-2016-
ulletinoct2016-3090545.html - http://rhn.redhat.com/errata/RHSA-2016-2045.html - http://rhn.redhat.com/errata/RHSA-2016-2046.html - https://tomcat.apache.org/tomcat-7.0-doc/changelog.html - http://www.securityfocus.com/bid/91818 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - http://rhn.redhat.com/errata/RHSA-2016-1624.html - https://www.apache.org/security/asf-httpoxy-response.txt - https://httpoxy.org/ - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html -
poxy-response.txt - https://httpoxy.org/ - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://www.securitytracker.com/id/1036331 - https://access.redhat.com/errata/RHSA-2016:1636 - https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html - https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E - https://lists.apache.or
ml/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E
CVE ID: CVE-2016-5389 State: REJECTED Published: 2016-07-13T16:00:00 Last Updated: 2016-07-13T15:57:01 Description: No description available.
CVE ID: CVE-2016-5390 State: PUBLISHED Published: 2016-08-19T21:00:00 Last Updated: 2024-08-06T01:00:59.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces. Additional Analyst Notes: - CVE Program Container: References: - http://projects.theforeman.org/issues/15653 - https://bugzilla.redhat.com/show_bug.cgi?id=1355728 - https://theforeman.org/security.html#2016-5390 - http://www.securityf
ps://bugzilla.redhat.com/show_bug.cgi?id=1355728 - https://theforeman.org/security.html#2016-5390 - http://www.securityfocus.com/bid/91770
CVE ID: CVE-2016-5391 State: PUBLISHED Published: 2017-06-13T17:00:00 Last Updated: 2024-08-06T01:00:59.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart). Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65R6OA5AY7K2UBQUDOLOS5Y3SCULQI6I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKMS7R4TG6LTAGEBOWVUXF6LAWQXLNXV/ - https://bugzilla.redhat.com/show_bug.cgi?id=1356183 - https://libreswan.o
rg/message/UKMS7R4TG6LTAGEBOWVUXF6LAWQXLNXV/ - https://bugzilla.redhat.com/show_bug.cgi?id=1356183 - https://libreswan.org/security/CVE-2016-5391/CVE-2016-5391.txt
CVE ID: CVE-2016-5392 State: PUBLISHED Published: 2016-08-05T15:00:00 Last Updated: 2024-08-06T01:00:59.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91793 - https://bugzilla.redhat.com/show_bug.cgi?id=1356195 - https://access.redhat.com/errata/RHSA-2016:1427
CVE ID: CVE-2016-5393 State: PUBLISHED Published: 2016-11-29T06:00:00 Last Updated: 2024-08-06T01:00:59.856Z Vendors: n/a Products: Apache Hadoop Problem Types: arbitrary command execution Description: In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E - http://www.securityfocus.com/bid/94574
CVE ID: CVE-2016-5394 State: PUBLISHED Published: 2017-07-19T15:00:00Z Last Updated: 2024-09-16T22:21:15.752Z Vendors: Apache Software Foundation Products: Apache Sling Problem Types: n/a Description: In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apache.org%3E - http://www.securityfocus.com/bid/99870
CVE ID: CVE-2016-5395 State: PUBLISHED Published: 2016-09-26T14:00:00 Last Updated: 2024-08-06T01:00:59.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger - http://www.securityfocus.com/bid/92577
CVE ID: CVE-2016-5396 State: PUBLISHED Published: 2017-04-17T18:00:00 Last Updated: 2024-08-06T01:00:59.916Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: DoS attack Description: Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/TS-5019 - http://www.securityfocus.com/bid/97945 - http://www.securitytracker.com/id/1038275
CVE ID: CVE-2016-5397 State: PUBLISHED Published: 2018-02-12T17:00:00Z Last Updated: 2024-09-16T20:47:38.486Z Vendors: Apache Software Foundation Products: Apache Thrift Problem Types: Command Injection Description: The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103025 - https://access.redhat.com/errata/RHSA-2018:2669 - https://issues.apache.org/jira/browse/THRIFT-3893 - http://mail-archives.apache.org/mod_mbox/thrift-user/201701
8:2669 - https://issues.apache.org/jira/browse/THRIFT-3893 - http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E - https://access.redhat.com/errata/RHSA-2019:3140 - https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E
CVE ID: CVE-2016-5398 State: PUBLISHED Published: 2016-10-03T18:00:00 Last Updated: 2024-08-06T01:00:59.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93219 - https://bugzilla.redhat.com/show_bug.cgi?id=1358523 - http://rhn.redhat.com/errata/RHSA-2016-1969.html - http://rhn.redhat.com/errata/RHSA-2016-1968.html
CVE ID: CVE-2016-5399 State: PUBLISHED Published: 2017-04-21T20:00:00 Last Updated: 2024-08-06T01:01:00.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92051 - http://packetstormsecurity.com/files/137998/PHP-7.0.8-5.6.23-5.5.37-bzread-OOB-Write.html - http://seclists.org/fulldisclosure/2016/Jul/72 - https://bugzilla.redhat.com/show_bug.cgi?id=1358395 - ht
B-Write.html - http://seclists.org/fulldisclosure/2016/Jul/72 - https://bugzilla.redhat.com/show_bug.cgi?id=1358395 - http://www.openwall.com/lists/oss-security/2016/07/21/1 - http://www.securityfocus.com/archive/1/538966/100/0/threaded - https://bugs.php.net/bug.php?id=72613 - http://rhn.redhat.com/errata/RHSA-2016-2750.html - http://rhn.redhat.com/errata/RHSA-2016-2598.html - http://php.net/ChangeLog-5.php - https://security.netapp.com/advisory/ntap-20180112-0001/ - http://www.securitytracker.com/id/1036430 - http://www.debian.org/security/2016/dsa-3631 - http://php.net/ChangeLog-7.php - https://www.exploit-db.com/exploits/40155/
CVE ID: CVE-2016-5400 State: PUBLISHED Published: 2016-08-06T20:00:00 Last Updated: 2024-08-06T01:00:59.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-3070-1 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa93d1fee85c89
www.ubuntu.com/usn/USN-3070-1 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa93d1fee85c890a34f2510a310e55ee76a27848 - https://bugzilla.redhat.com/show_bug.cgi?id=1358184 - http://www.ubuntu.com/usn/USN-3070-3 - http://www.openwall.com/lists/oss-security/2016/07/25/1 - http://www.ubuntu.com/usn/USN-3070-2 - http://www.securitytracker.com/id/1036432 - http://www.ubuntu.com/usn/USN-3070-4 - https://github.com/torvalds/linux/commit/aa93d1fee85c890a34f2510a310e55ee76a27848 - http://www.securityfocus.com/bid/92104
CVE ID: CVE-2016-5401 State: PUBLISHED Published: 2017-04-20T21:00:00 Last Updated: 2024-08-06T01:00:59.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1357731
CVE ID: CVE-2016-5402 State: PUBLISHED Published: 2018-10-31T13:00:00 Last Updated: 2024-08-06T01:00:59.994Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: cfme Problem Types: CWE-94 Description: A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5402 - http://www.securityfocus.com/bid/94612 - http://rhn.redhat.com/
ps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5402 - http://www.securityfocus.com/bid/94612 - http://rhn.redhat.com/errata/RHSA-2016-2839.html
CVE ID: CVE-2016-5403 State: PUBLISHED Published: 2016-08-02T16:00:00 Last Updated: 2024-08-06T01:00:59.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://rhn.redhat.com/errata/RHSA-2016-1756.html - http://xenbits.xen.org/xsa/advisory-184.html - http://www.ubuntu.com/usn/USN-3047-1 - http://rhn.redhat.com/er
56.html - http://xenbits.xen.org/xsa/advisory-184.html - http://www.ubuntu.com/usn/USN-3047-1 - http://rhn.redhat.com/errata/RHSA-2016-1655.html - https://bugzilla.redhat.com/show_bug.cgi?id=1358359 - http://rhn.redhat.com/errata/RHSA-2016-1763.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html - http://rhn.redhat.com/errata/RHSA-2016-1585.html - http://rhn.redhat.com/errata/RHSA-2016-1653.html - http://rhn.redhat.com/errata/RHSA-2016-1607.html - http://rhn.redhat.com/errata/RHSA-2016-1654.html - http://www.securitytracker.com/id/1036476 - http://www.ubuntu.com/usn/US
p://rhn.redhat.com/errata/RHSA-2016-1654.html - http://www.securitytracker.com/id/1036476 - http://www.ubuntu.com/usn/USN-3047-2 - http://rhn.redhat.com/errata/RHSA-2016-1606.html - http://rhn.redhat.com/errata/RHSA-2016-1586.html - http://rhn.redhat.com/errata/RHSA-2016-1943.html - http://www.securityfocus.com/bid/92148 - http://rhn.redhat.com/errata/RHSA-2016-1652.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
CVE ID: CVE-2016-5404 State: PUBLISHED Published: 2016-09-07T20:00:00 Last Updated: 2024-08-06T01:01:00.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=cf74584d0f772f3f5eccc1d30c001e4212a104fd - https://lists.fedoraproject.org/archives/list/package-announce%4
t/commit/?id=cf74584d0f772f3f5eccc1d30c001e4212a104fd - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5OROLKFSY5QRQS7NGBNDP5QMOBV3XMZ/ - http://www.securityfocus.com/bid/92525 - http://www.openwall.com/lists/oss-security/2016/08/17/9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PZ2ZQTMGC2UBRNHXVVOY3PJDOBP4CP4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQDYWANTMDFZP3HTGSEOA2IONVUITYX5/ - http://rhn.redhat.com/errata/RHSA-2016-1797.html - https://fedorahosted.org/freeipa/ticket/6232
CVE ID: CVE-2016-5405 State: PUBLISHED Published: 2017-06-08T19:00:00 Last Updated: 2024-08-06T01:00:59.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1358865 - http://rhn.redhat.com/errata/RHSA-2016-2594.html - http://rhn.redhat.com/errata/RHSA-2016-2765.html - http://www.securityfocus.com/bid/93884
CVE ID: CVE-2016-5406 State: PUBLISHED Published: 2016-09-26T14:00:00 Last Updated: 2024-08-06T01:00:59.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to all slaves. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-1841.html - https://access.redhat.com/errata/RHSA-2017:3458 - https://bugzilla.redhat.com/show_bug.cgi?id=1359014 - http://rhn.redhat.com/errata/RHSA-2016-1838.html - https://access.redhat.com/erra
a.redhat.com/show_bug.cgi?id=1359014 - http://rhn.redhat.com/errata/RHSA-2016-1838.html - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2017:3454 - http://rhn.redhat.com/errata/RHSA-2016-1839.html - http://rhn.redhat.com/errata/RHSA-2016-1840.html
CVE ID: CVE-2016-5407 State: PUBLISHED Published: 2016-12-13T20:00:00 Last Updated: 2024-08-06T01:00:59.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036945 - http://www.securityfocus.com/bid/93368 - https://security.gentoo.org/glsa/201704-03 - https://lists.x.org/archives/xorg-announce/2016-October/002720.html - http://www.openwall.com/lists/oss-security/2