Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
2138e062f77cc09581b723cf95a%40%3Ccommits.activemq.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7%40%3Ccommits.activemq.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2020-1942 State: PUBLISHED Published: 2020-02-11T20:57:26 Last Updated: 2024-08-04T06:54:00.412Z Vendors: n/a Products: Apache NiFi Problem Types: Information Disclosure Description: In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2020-1942
CVE ID: CVE-2020-1943 State: PUBLISHED Published: 2020-04-01T18:18:48 Last Updated: 2024-08-04T06:53:59.927Z Vendors: Apache Products: Apache OFBiz Problem Types: XSS Vulnerability Description: Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/pr5u8 - https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r8efd5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757%40%3Cdev.ofbiz.apache.org%3E - https://lists.apache.org/thread.htm
d5b62604d849ae2f93b2eb9ce0ce0356a4cf5812deed14030a757%40%3Cdev.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/ra6c011af63d8a8cd8c0b8f72b2b0c392af4d5ed040ba59be344d13fa%40%3Cdev.ofbiz.apache.org%3E
CVE ID: CVE-2020-1944 State: PUBLISHED Published: 2020-03-23T21:46:47 Last Updated: 2024-08-04T06:54:00.400Z Vendors: n/a Products: Apache Traffic Server Problem Types: Information Disclosure Description: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E - https://www.debian.org/security/2020/dsa-4672
CVE ID: CVE-2020-1945 State: PUBLISHED Published: 2020-05-14T15:57:34 Last Updated: 2024-08-04T06:54:00.377Z Vendors: n/a Products: Apache Ant Problem Types: insecure temporary file vulnerability Description: Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rda80ac591
rocess. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rda80ac59119558eaec452e58ddfac2ccc9211da1c65f7927682c78b1%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/rfd346609527a79662c48b1da3ac500ec30f29f7ddaa3575051e81890%40%3Ccommits.creadur.apache.org%3E - https://lists.apache.org/thread.html/re1ce84518d773a94a613d988771daf9252c9cf7375a9a477009f9735%40%3Ccommits.creadur.apache.org%3E - https://lists.apache.org/thread.html/r95dc943e47a211d29df605e14f86c280fc9fa8d828b2b53bd07673c9%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/rd7dda48ff835f4d0293949837d55541bfde3683bd35bd8431e324538%40%3Cdev.cre
che.org%3E - https://lists.apache.org/thread.html/rd7dda48ff835f4d0293949837d55541bfde3683bd35bd8431e324538%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r1863b9ce4c3e4b1e5b0c671ad05545ba3eb8399616aa746af5dfe1b1%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/rdaa9c51d5dc6560c9d2b3f3d742c768ad0705e154041e574a0fae45c%40%3Cnotifications.groovy.apache.org%3E - https://lists.apache.org/thread.html/r1b32c76afffcf676e13ed635a3332f3e46e6aaa7722eb3fc7a28f58e%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/r0d08a96ba9de8aa435f32944e8b2867c368a518d4ff57782e3637335%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r4b2
e8aa435f32944e8b2867c368a518d4ff57782e3637335%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r4b2904d64affd4266cd72ccb2fc3927c1c2f22009f183095aa46bf90%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r6edd3e2cb79ee635630d891b54a4f1a9cd8c7f639d6ee34e75fbe830%40%3Cissues.hive.apache.org%3E - https://usn.ubuntu.com/4380-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRVAWTCVXJMRYKQKEXYSNBF7NLSR6OEI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EQBR65TINSJRN7PTPIVNYS33P535WM74/ - https://lists.apache.org/thread.html/r8e24abb7dd77cda14c6df90a377c
oject.org/message/EQBR65TINSJRN7PTPIVNYS33P535WM74/ - https://lists.apache.org/thread.html/r8e24abb7dd77cda14c6df90a377c94f0a413bbfcec90a29540ff8adf%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r2704fb14ce068c64759a986f81d5b5e42ab434fa13d0f444ad52816b%40%3Cdev.creadur.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78c453621b82c14e7b75e%40%3Cdev.ant.apache.org%3E - https://lists.apache.org/thread.html/r6e295d792032ec02b32be3846c21a58857fba4a077d22c5842d69ba2%40%3Ctorque-dev.db.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html - ht
69ba2%40%3Ctorque-dev.db.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00053.html - https://security.gentoo.org/glsa/202007-34 - https://lists.apache.org/thread.html/r815f88d1044760176f30a4913b4baacd06f3eae4eb662de7388e46d8%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r5dfc77048b1f9db26622dce91a6edf083d499397256594952fad5f35%40%3Ccommits.myfaces.apache.org%3E - https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E - https://lists.apache.org/thread.html/rb8ec556f176c83547b959150e2108e2ddf1d61224295941908b0a81f%40%3Cannounce.apache.org%3E - https://lists.apache.org/thr
tml/rb8ec556f176c83547b959150e2108e2ddf1d61224295941908b0a81f%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rc89e491b5b270fb40f1210b70554527b737c217ad2e831b643ead6bc%40%3Cuser.ant.apache.org%3E - https://lists.apache.org/thread.html/rf07feaf78afc8f701e21948a06ef92565d3dff1242d710f4fbf900b2%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r1a9c992d7c8219dc15b4ad448649f0ffdaa88d76ef6a0035c49455f5%40%3Cdev.creadur.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/09/30/6 - https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r4ca
c42ecca5ff82d0d2de64cd5d3a4fa691eb9ee0304781e%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e706e6f2cf2339b95729490%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef542146ae22952e1013b5cc%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8467388158bcd19c1094e0%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a6703d666d72d717319305%40%3Cdev.creadur.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/r3cea0f3da4f6d0
e.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/r3cea0f3da4f6d06d7afb6c0804da8e01773a0f50a09b8d9beb2cda65%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r6030d34ceacd0098538425c5dac8251ffc7fd90b886942bc7ef87858%40%3Cnotifications.groovy.apache.org%3E - https://lists.apache.org/thread.html/rce099751721c26a8166d8b6578293820832831a0b2cb8d93b8efa081%40%3Cnotifications.groovy.apache.org%3E - https://lists.apache.org/thread.html/r6970d196cd73863dafdbc3a7052562deedd338e3bd7d73d8171d92d6%40%3Ccommits.groovy.apache.org%3E - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3
oovy.apache.org%3E - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cusers.groovy.apache.org%3E - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cdev.groovy.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/12/06/1 - https://lists.apache.org/thread.html/ra12c3e23b021f259a201648005b9946acd7f618a6f32301c97047967%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/ra9dab34bf8625511f23692ad0fcee2725f782e9aad6c5cdff6cf4465%40%3Cnotifications.groovy.apache.org%3E - https://lists.apache.org/thread.html/rb860063819b9c0990e1fbce29d83f4554766fe5a05e3b3939736bf2b%40%3Ccom
.apache.org%3E - https://lists.apache.org/thread.html/rb860063819b9c0990e1fbce29d83f4554766fe5a05e3b3939736bf2b%40%3Ccommits.myfaces.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/raaeddc41da8f3afb1cb224876084a45f68e437a0afd9889a707e4b0c%40%3Cdev.creadur.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/rbfe9ba28b74f39f46ec1bbbac3bef313f35017cf3aac13841a84483a%40%3Cdev.creadur.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2020-1946 State: PUBLISHED Published: 2021-03-25T09:20:11.000Z Last Updated: 2025-02-13T16:27:40.012Z Vendors: Apache Software Foundation Products: Apache SpamAssassin Problem Types: CWE-78 Description: In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places. Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/3r1wh - https://www.debian.org/security/2021/dsa-4879 - http
- CVE Program Container: References: - https://s.apache.org/3r1wh - https://www.debian.org/security/2021/dsa-4879 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V2SBVTKVLFFT36ECJQ7TQ7KAQCQZDRZ/ - https://lists.debian.org/debian-lts-announce/2021/04/msg00000.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFBFRIG5TX23NF4ND6OAKKY7I6TLRCCP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKAXYBKBMQOLIW6UKASJCAZRBOIYS4RL/ - https://security.gentoo.org/glsa/202105-26
CVE ID: CVE-2020-1947 State: PUBLISHED Published: 2020-03-11T20:40:53 Last Updated: 2024-08-04T06:54:00.370Z Vendors: Apache Software Foundation Products: Apache ShardingSphere(incubator) Problem Types: Remote Code Execution Description: In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r4a61a24c119bd820da6fb02100d286f8aae55c8f9b94a34
E Program Container: References: - https://lists.apache.org/thread.html/r4a61a24c119bd820da6fb02100d286f8aae55c8f9b94a346b9bb27d8%40%3Cdev.shardingsphere.apache.org%3E
CVE ID: CVE-2020-1948 State: PUBLISHED Published: 2020-07-14T13:11:31 Last Updated: 2024-08-04T06:53:59.966Z Vendors: n/a Products: Apache Dubbo Problem Types: Remote Code Execution through Deserialization Description: This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%4
ontainer: References: - https://lists.apache.org/thread.html/rbaa41711b3e7a8cd20e9013737423ddd079ddc12f90180f86e76523c%40%3Csecurity.dubbo.apache.org%3E
CVE ID: CVE-2020-1949 State: PUBLISHED Published: 2020-04-01T18:25:32 Last Updated: 2024-08-04T06:53:59.928Z Vendors: n/a Products: Apache Sling Problem Types: Improper Neutralization of Input During Web Page Generation Description: Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/CVE-2020-1949
CVE ID: CVE-2020-1950 State: PUBLISHED Published: 2020-03-23T13:21:52 Last Updated: 2024-08-04T06:54:00.402Z Vendors: Apache Products: Apache Tika Problem Types: Excessive memory usage (DoS) vulnerability in Apache Tika's PSDParser Description: A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/03/msg00035.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://lists.apache.org/thread.html/r463b1a67817ae55fe022536edd6db34e8f9636971188430cbcf8a8dd%40%3Cdev.tika.apache.org%3E - https://usn.ubunt
rg/thread.html/r463b1a67817ae55fe022536edd6db34e8f9636971188430cbcf8a8dd%40%3Cdev.tika.apache.org%3E - https://usn.ubuntu.com/4564-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2020-1951 State: PUBLISHED Published: 2020-03-23T13:26:37 Last Updated: 2024-08-04T06:54:00.380Z Vendors: n/a Products: Apache Tika Problem Types: Infinite Loop (DoS) vulnerability in Apache Tika's PSDParser Description: A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/03/msg00035.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://lists.apache.org/thread.html/rd8c1b42bd0e31870d804890b3f00b13d837c528f7ebaf77031323172%40%3Cdev.tika.apache.org%3E - https://usn.ubuntu.com/4564-1/ - ht
c1b42bd0e31870d804890b3f00b13d837c528f7ebaf77031323172%40%3Cdev.tika.apache.org%3E - https://usn.ubuntu.com/4564-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2020-1952 State: PUBLISHED Published: 2020-04-27T16:16:12 Last Updated: 2024-08-04T06:54:00.401Z Vendors: Apache Products: IoTDB Problem Types: Information Disclosure Description: An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r3d2ff899ead64d2952fdc1fbb1f520ca42011ed2b4c7f786e921f6b9%40%3Cdev.iotdb.apache.org%3E
CVE ID: CVE-2020-1953 State: PUBLISHED Published: 2020-03-13T14:58:49 Last Updated: 2024-08-04T06:53:59.884Z Vendors: Apache Products: Apache Commons Configuration Problem Types: Code execution Description: Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application. Additional Analyst Notes: - CVE Program Container: References: - htt
te code out of the control of the host application. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E
CVE ID: CVE-2020-1954 State: PUBLISHED Published: 2020-04-01T20:07:29 Last Updated: 2024-08-04T06:54:00.267Z Vendors: Apache Products: Apache CXF Problem Types: Information Disclosure Description: Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent a
rver, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuoct2020.html - http://cxf.apache.org/security-advisories.data/CVE-2020-1954.txt.asc?version=1&modificationDate=1585730169000&api=v2 - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed
6c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E - https://security.netapp.com/advisory/ntap-20220210-0001/
CVE ID: CVE-2020-1955 State: PUBLISHED Published: 2020-05-20T13:53:44 Last Updated: 2024-08-04T06:54:00.400Z Vendors: n/a Products: Apache CouchDB Problem Types: Remote Privilege Escalation Description: CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. It was meant as an extension to the long standing setting `require_valid_user`, which in turn requires that any and all requests to CouchDB will have to be made with valid credentials, effectively forbidding any anonymous requests. The new `require_valid_user_except_for_up` is an off-by-default setting that was meant to allow requi
nonymous requests. The new `require_valid_user_except_for_up` is an off-by-default setting that was meant to allow requiring valid credentials for all endpoints except for the `/_up` endpoint. However, the implementation of this made an error that lead to not enforcing credentials on any endpoint, when enabled. CouchDB versions 3.0.1[1] and 3.1.0[2] fix this issue. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchdb.org/en/master/cve/2020-1955.html
CVE ID: CVE-2020-1956 State: PUBLISHED Published: 2020-05-22T13:27:43.000Z Last Updated: 2025-10-21T23:35:43.316Z Vendors: Apache Products: Kylin Problem Types: Command Injection Description: Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E - https://community.sonarsource.com/t/apache-kylin-3-0-1-comma
1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E - https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706 - https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E - https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E - https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E - https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-sec
867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E - http://www.openwall.com/lists/oss-security/2020/07/14/1 - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
CVE ID: CVE-2020-1957 State: PUBLISHED Published: 2020-03-25T15:24:27 Last Updated: 2024-08-04T06:54:00.565Z Vendors: n/a Products: Apache Shiro Problem Types: Authentication Bypass Description: Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r17f371fc89d34df2d0c8131473fbc68154290e1be238895648f5a1e6%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/rc64fb2336683feff3580c3c3a8b28e80525077621089641f2f386b63%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html
6683feff3580c3c3a8b28e80525077621089641f2f386b63%40%3Ccommits.camel.apache.org%3E - https://lists.apache.org/thread.html/rb3982edf8bc8fcaa7a308e25a12d294fb4aac1f1e9d4e14fda639e77%40%3Cdev.geode.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/04/msg00014.html - https://lists.apache.org/thread.html/rc8b39ea8b3ef71ddc1cd74ffc866546182683c8adecf19c263fe7ac0%40%3Ccommits.shiro.apache.org%3E - https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E - https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3%40%3Ccommits.shiro.apache.org%3E
CVE ID: CVE-2020-1958 State: PUBLISHED Published: 2020-04-01T21:48:33 Last Updated: 2024-08-04T06:54:00.299Z Vendors: Apache Products: Apache Druid Problem Types: Unauthorized access and information disclosure Description: When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible t