Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E - https://www.debian.org/security/2018/dsa-4281 - https://access.redhat.com/errata/RHSA-2018:2939 - https://access.redhat.com/errata/RHSA-2018:0465 - https://usn.ubuntu.com/3665-1/ - http://www.securitytracker.com/id/1040427 - https://access.redhat.com/errata/RHSA-2018:1320 - https://access.redhat.com/errata/RHSA-2018:1451 - https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html - https://access.redhat.com/errata/RHSA-2018:0466 - https://access.redh
an.org/debian-lts-announce/2018/07/msg00044.html - https://access.redhat.com/errata/RHSA-2018:0466 - https://access.redhat.com/errata/RHSA-2018:1447 - https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev
t.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc0
a94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2019:2205 - https://lists.apache.org/thread.html/r6ccee4e8
ujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2019:2205 - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-1305 State: PUBLISHED Published: 2018-02-23T23:00:00Z Last Updated: 2024-09-17T01:12:10.097Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Information Disclosure Description: Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not author
loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103144 - https://security.netapp.com/advisory/ntap-20180706-0001/ - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://www.debian.org/security/2018/dsa-4281 - https://access.redhat.com/errata/RHSA-2018:2939 - https://access.redhat.com/errata/RHSA-2018:0465 - https://usn.ubuntu.com/3665-1/ - https://access.redhat.com/errata/RHSA-2018:1320 - https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html - http://www.orac
.redhat.com/errata/RHSA-2018:1320 - https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E - https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html - https://access.redhat.com/errata/RHSA-2018:0466 - https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html - http://www.securitytracker.com/id/1040428 - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thr
ml/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.t
apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8f
328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2019:2205 - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b
1eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-1306 State: PUBLISHED Published: 2018-06-27T18:00:00Z Last Updated: 2024-09-16T18:49:31.524Z Vendors: Apache Software Foundation Products: Apache Pluto Problem Types: Information Disclosure Description: The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45396/ - http://portals.apach
Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45396/ - http://portals.apache.org/pluto/security.html
CVE ID: CVE-2018-1307 State: PUBLISHED Published: 2018-02-09T19:00:00Z Last Updated: 2024-09-16T19:24:28.480Z Vendors: Apache Software Foundation Products: Apache jUDDI Problem Types: XML Entity Expansion Description: In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/JUDDI-987 - http://juddi.apache.org/security.html
CVE ID: CVE-2018-1308 State: PUBLISHED Published: 2018-04-09T13:00:00Z Last Updated: 2024-09-17T02:47:11.497Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: Information Disclosure Description: This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4194 - https://lists.debian.org/debian-lts-announc
ram Container: References: - https://www.debian.org/security/2018/dsa-4194 - https://lists.debian.org/debian-lts-announce/2018/04/msg00025.html - https://mail-archives.apache.org/mod_mbox/www-announce/201804.mbox/%3C000001d3cf68%245ac69af0%241053d0d0%24%40apache.org%3E - https://issues.apache.org/jira/browse/SOLR-11971 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
CVE ID: CVE-2018-1309 State: PUBLISHED Published: 2018-05-23T14:00:00Z Last Updated: 2024-09-16T16:13:12.482Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Information Disclosure / Remote Code Execution Description: Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CV
riate release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2018-1309
CVE ID: CVE-2018-1310 State: PUBLISHED Published: 2018-05-23T14:00:00Z Last Updated: 2024-09-16T23:15:51.628Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Denial of Service Description: Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2018
release. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2018-1310
CVE ID: CVE-2018-1311 State: PUBLISHED Published: 2019-12-18T00:00:00.000Z Last Updated: 2025-11-04T18:14:14.531Z Vendors: Apache Software Foundation Products: Apache Xerces-C Problem Types: Denial of Service and Remote Exploit Description: The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. Additional Analyst Notes: - CVE Program Container: Referenc
r via SAX using the XERCES_DISABLE_DTD environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0704 - https://access.redhat.com/errata/RHSA-2020:0702 - https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html - https://www.debian.org/security/2020/dsa-4814 - https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3E - https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40
xerces.apache.org%3E - https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3E - https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://marc.info/?l=xerces-c-users&m=157653840106914&w=2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/ - https://lists.debian.org/debian-
/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/ - https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html - http://www.openwall.com/lists/oss-security/2024/02/16/1
CVE ID: CVE-2018-1312 State: PUBLISHED Published: 2018-03-26T15:00:00Z Last Updated: 2024-09-16T19:14:07.045Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Authentication replay mitigation Description: In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3627-1/ - https://www.debian.org/
dditional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3627-1/ - https://www.debian.org/security/2018/dsa-4164 - https://security.netapp.com/advisory/ntap-20180601-0004/ - https://access.redhat.com/errata/RHSA-2018:3558 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - https://usn.ubuntu.com/3627-2/ - http://www.securityfocus.com/bid/103524 - http://www.openwall.com/lists/oss-security/2018/03/24/7 - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html - http://www.securitytracker.com/id/104
ies_24.html - https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html - http://www.securitytracker.com/id/1040571 - https://access.redhat.com/errata/RHSA-2019:0366 - https://usn.ubuntu.com/3937-2/ - https://access.redhat.com/errata/RHSA-2019:1898 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apa
g/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3
Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142
b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-1313 State: PUBLISHED Published: 2018-05-07T13:00:00Z Last Updated: 2024-09-16T16:23:24.352Z Vendors: Apache Software Foundation Products: Apache Derby Problem Types: externally-controlled input vulnerability Description: In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Se
file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://markmail.org/message/akkappppxcdqrgxk - http://www.securityfocus.com/bid/104140 - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e7
2ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/re29ab90978e6c997377fb975f674f7514f6beb642bbf79deb45477e5%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/r437d94437e6aef31af689b1e7025d024d676fd1ea9901d74e3e9ae48%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r6755f48d4f5e44e39bba7dbf8d746678239d7f1f2cc108125519ce53%40%3Cissues.hive.apache.org%3E
CVE ID: CVE-2018-1314 State: PUBLISHED Published: 2018-11-08T14:00:00 Last Updated: 2024-08-05T03:59:39.039Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: Improper Access Control Description: In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105884 - https://lists.apache.org/thread.html/3da47dbcbf09697387f29d2f1aed970523b6b334d93afd3cced23727%40%3Cdev.hive.apache.org%3E
CVE ID: CVE-2018-1315 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-17T00:05:55.849Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: Resource Injection Description: In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not verify the destination location of the downloaded file. This does not affect hive cli user and hiveserver2 user as hplsql is a separate command line script and needs to be invoked differently.
fect hive cli user and hiveserver2 user as hplsql is a separate command line script and needs to be invoked differently. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/d5da94ef60312c01a8d2348466680d1b5fb70702c71a3e84e94f7933%40%3Cdev.hive.apache.org%3E
CVE ID: CVE-2018-1316 State: PUBLISHED Published: 2018-03-05T14:00:00Z Last Updated: 2024-09-17T03:07:11.345Z Vendors: Apache Software Foundation Products: Apache ODE Problem Types: Directory Traversal Description: The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake. Additional Analyst Notes: - CVE Program Container: Refere
orrect name CVE-2008-2370 was used on the advisory by mistake. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ce416ddfba1a87f4b8e2d8125f1c3b45d1f0b350af29a4d0405e213b%40%3Cuser.ode.apache.org%3E - http://mail-archives.apache.org/mod_mbox/www-announce/200908.mbox/%3Cfbdc6a970908072141w20a7a9d9ka1f896ad8073dffb%40mail.gmail.com%3E
CVE ID: CVE-2018-1317 State: PUBLISHED Published: 2019-04-23T14:45:20 Last Updated: 2024-08-05T03:59:38.240Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: Improper Authentication Description: In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ff6b995a5a3ba8db4d6b14b4d9dd487e7bf2e3bdd5b375b64a25fd06%40%3Cusers.zeppelin.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/04/23/1 - https://zeppelin.apache.org/releases/zeppelin-release-0.8.0.html - ht