Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-opensource/wlan/qcacld-3.0/commit/?id=50a0554d12cff58b3ffbd51d3194304244b87023 - https://source.android.com/security/bulletin/pixel/2018-03-01
CVE ID: CVE-2017-18056 State: PUBLISHED Published: 2018-03-15T21:00:00 Last Updated: 2024-08-05T21:06:50.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_id in wma_unified_bcntx_status_event_handler() which is received from firmware leads to potential out of bounds memory read. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-03-01 - http://www.securityfocus.com/bid/103254
CVE ID: CVE-2017-18057 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-17T01:55:39.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nlo_scan_cmp_evt_handler(), which is received from firmware, leads to potential out of bounds memory read. Additional Analyst Notes: - CVE Program Container: References: - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=24d41d2bd3d98325b3800345f4ba27a334b3894b - https://source.android.com/security/bulletin/pixel/2018-03-01
CVE ID: CVE-2017-18058 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-16T18:34:34.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wow_buf_pkt_len in wma_wow_wakeup_host_event() which is received from firmware leads to potential out of bounds memory read. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2018-03-01 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d6d42a10d4abf09299cdfacdd8aed5c26731b
.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d6d42a10d4abf09299cdfacdd8aed5c26731b5ff
CVE ID: CVE-2017-18059 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-17T02:36:07.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_scan_event_callback(), which is received from firmware, leads to potential out of bounds memory read. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2018-03-01 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=217705da7726002ffe61dad51a6c9cc97c52f649
CVE ID: CVE-2017-18060 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-17T02:21:51.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_id in wma_unified_bcntx_status_event_handler(), which is received from firmware, leads to potential out of bounds memory read. Additional Analyst Notes: - CVE Program Container: References: - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=f3d81bd0b3cb992c214d94196b33168b02589c6b - https://source.android.com/security/bul
opensource/wlan/qcacld-3.0/commit/?id=f3d81bd0b3cb992c214d94196b33168b02589c6b - https://source.android.com/security/bulletin/pixel/2018-03-01
CVE ID: CVE-2017-18061 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-16T17:58:26.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wil_aoa_evt_meas(). Additional Analyst Notes: - CVE Program Container: References: - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b65cf2a007e88fe86dbd6d3269682fc585a4130f - https://source.android.com/security/bulletin/pixel/2018-03-01
CVE ID: CVE-2017-18062 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-16T22:15:59.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing UTF event in wma_process_utf_event(). Additional Analyst Notes: - CVE Program Container: References: - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d7927eb7c9c2d79a3e24cddd1e9447ab98bf6700 - https://source.android.com/security/bulletin/pixel/2018-03-01
CVE ID: CVE-2017-18063 State: PUBLISHED Published: 2018-03-15T21:00:00 Last Updated: 2024-08-05T21:13:47.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for nlo_event in wma_nlo_match_evt_handler(), which is received from firmware, leads to potential out of bound memory access. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-03-01 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=b9c0beac8f021f774f39df54e1f96fd87c2660f0 - http
a.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=b9c0beac8f021f774f39df54e1f96fd87c2660f0 - http://www.securityfocus.com/bid/103254
CVE ID: CVE-2017-18064 State: PUBLISHED Published: 2018-03-15T21:00:00 Last Updated: 2024-08-05T21:13:47.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for p2p_noa_info in wma_send_bcn_buf_ll() which is received from firmware leads to potential buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-03-01 - http://www.securityfocus.com/bid/103254 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=84f144bedd81ad154a26c
- https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=84f144bedd81ad154a26c76fb322903c25374d20
CVE ID: CVE-2017-18065 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-16T17:18:15.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in wma_action_frame_filter_mac_event_handler(), which is received from firmware, leads to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2018-03-01 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a8bc0f90ef49ea0aee90047a17772e4e
ource.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a8bc0f90ef49ea0aee90047a17772e4eebff259a
CVE ID: CVE-2017-18066 State: PUBLISHED Published: 2018-03-16T22:00:00Z Last Updated: 2024-09-17T01:11:50.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper controls in MSM CORE leads to use memory after it is freed in msm_core_ioctl(). Additional Analyst Notes: - CVE Program Container: References: - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=ff11f44c0c10c94170f03a8698f73f7e08b74625 - https://source.android.com/security/bulletin/pixel/2018-03-01
CVE ID: CVE-2017-18067 State: PUBLISHED Published: 2018-03-15T21:00:00 Last Updated: 2024-08-05T21:13:47.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an encrypted authentication management frame in lim_send_auth_mgmt_frame() leads to buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-03-01 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=e1e9d0cb8a0bc33965d112725e205a78aab82986 - http://www.s
ic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=e1e9d0cb8a0bc33965d112725e205a78aab82986 - http://www.securityfocus.com/bid/103254
CVE ID: CVE-2017-18068 State: PUBLISHED Published: 2018-03-15T21:00:00 Last Updated: 2024-08-05T21:13:47.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper buffer length calculation in wma_roam_scan_filter() leads to buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-03-01 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=b91ad6cf984a48ad52fe5af13cb3e0ac4bf012ed - http://www.securityfocus.com/bid/103254
CVE ID: CVE-2017-18069 State: PUBLISHED Published: 2018-03-15T21:00:00 Last Updated: 2024-08-05T21:13:48.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper message length calculation in oem_cmd_handler() while processing a WLAN_NL_MSG_OEM netlink message leads to buffer overread. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-03-01 - http://www.securityfocus.com/bid/103254
CVE ID: CVE-2017-18070 State: PUBLISHED Published: 2018-06-12T20:00:00Z Last Updated: 2024-09-17T01:42:07.517Z Vendors: Qualcomm, Inc. Products: Android for MSM, Firefox OS for MSM, QRD Android Problem Types: Integer Overflow to Buffer Overflow in WLAN Description: In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_list" is very large which can then lead to a heap overwrite of the heap object end_rsp in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. Additional Analyst Notes: - CVE Program Container: References: - https://www.cod
M, QRD Android) using the Linux Kernel. Additional Analyst Notes: - CVE Program Container: References: - https://www.codeaurora.org/security-bulletin/2018/05/11/may-2018-code-aurora-security-bulletin-2
CVE ID: CVE-2017-18071 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-16T23:35:31.421Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile, Snapdragon Wear Problem Types: Improper Access Control in Core Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, debug policy can potentially be bypassed. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-18072 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-17T03:03:47.200Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile, Snapdragon Wear Problem Types: Information Exposure in WLAN Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the probe requests originated fr
808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the probe requests originated by this DUT. Hence, control the presence of which information elements is supported. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-18073 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-17T00:06:15.380Z Vendors: Qualcomm, Inc. Products: Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear Problem Types: Improper Input Validation in TrustZone Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 820, SD 820A, SD 835, the HLOS can gain access to unauthorized memory. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-18074 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-16T22:14:02.391Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile, Snapdragon Wear Problem Types: Improper Input Validation in Audio Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 800, SD 808, SD 810, SD 820, SD 835, while playing a .wma file with modified media header with non-standard bytes per second parameter value, a reachable assert occurs. Additional Analyst Notes: - CVE Prog
ader with non-standard bytes per second parameter value, a reachable assert occurs. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-18075 State: PUBLISHED Published: 2018-01-24T10:00:00 Last Updated: 2024-08-05T21:13:48.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102813 - https://usn.ubuntu.com/3619-2/ - https://www.kernel.org/pu
iner: References: - http://www.securityfocus.com/bid/102813 - https://usn.ubuntu.com/3619-2/ - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.13 - https://access.redhat.com/errata/RHSA-2018:2948 - https://github.com/torvalds/linux/commit/d76c68109f37cb85b243a1cf0f40313afd2bae68 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d76c68109f37cb85b243a1cf0f40313afd2bae68 - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-18076 State: PUBLISHED Published: 2018-01-26T19:00:00 Last Updated: 2024-08-05T21:13:47.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/omniauth/omniauth/pull/867 - https://www.debian.org/security/2018/dsa-4109 - https://bugs.debian.org/888523 - https://github.com/omniauth/omniauth/pull/867/commits/71866c5264122e196847a3980c43051446a03e9b
CVE ID: CVE-2017-18077 State: PUBLISHED Published: 2018-01-27T12:00:00Z Last Updated: 2024-09-17T00:56:19.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/juliangruber/brace-expansion/pull/35/commits/b13381281cead487cbdbfd6a69fb097ea5e456c3 - https://nodesecurity.io/advisories/338 - https://github.com/juliangruber/brace-expansion/issues/33 - https://bugs.debian.org/862712
CVE ID: CVE-2017-18078 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T21:13:47.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html - http://www.openwall.
Program Container: References: - http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html - http://www.openwall.com/lists/oss-security/2018/01/29/3 - https://www.exploit-db.com/exploits/43935/ - https://github.com/systemd/systemd/issues/7736 - http://packetstormsecurity.com/files/146184/systemd-Local-Privilege-Escalation.html - https://www.openwall.com/lists/oss-security/2018/01/29/4 - https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3C
per.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2017-18079 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T21:13:47.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102895 - https://github.com/torvalds/linux/commit/340d394a789518018f834ff70f7534fc463d3226 - https://usn.ubuntu.com/3655-1/ - https://usn.ubuntu.com/3655-2/ - http://git.kern
394a789518018f834ff70f7534fc463d3226 - https://usn.ubuntu.com/3655-1/ - https://usn.ubuntu.com/3655-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=340d394a789518018f834ff70f7534fc463d3226 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.4
CVE ID: CVE-2017-18080 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T20:47:51.576Z Vendors: Atlassian Products: Bamboo Problem Types: Cross-Site Request Forgery (CSRF) Description: The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-19664
CVE ID: CVE-2017-18081 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T23:35:48.417Z Vendors: Atlassian Products: Bamboo Problem Types: Cross Site Scripting (XSS) Description: The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the value of the csrf token cookie. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-19665 - http://www.securityfocus.com/bid/103087
CVE ID: CVE-2017-18082 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T18:38:32.846Z Vendors: Atlassian Products: Bamboo Problem Types: Cross Site Scripting (XSS) Description: The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a branch. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-19666
CVE ID: CVE-2017-18083 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T18:09:18.179Z Vendors: Atlassian Products: Confluence Problem Types: Cross Site Scripting (XSS) Description: The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of an uploaded file. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-54903
CVE ID: CVE-2017-18084 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-16T20:28:09.477Z Vendors: Atlassian Products: Confluence Problem Types: Cross Site Scripting (XSS) Description: The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the description of a macro. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-54904 - http://www.securityfocus.com/bid/103064
CVE ID: CVE-2017-18085 State: PUBLISHED Published: 2018-02-02T14:00:00Z Last Updated: 2024-09-17T03:22:54.533Z Vendors: Atlassian Products: Confluence Problem Types: Cross Site Scripting (XSS) Description: The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the key parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103062 - https://jira.atlassian.com/browse/CONFSERVER-54905
CVE ID: CVE-2017-18086 State: PUBLISHED Published: 2018-02-02T14:00:00 Last Updated: 2024-08-05T21:13:48.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuesURL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-54907 - http://www.securityfocus.com/bid/103061
CVE ID: CVE-2017-18087 State: PUBLISHED Published: 2018-02-15T13:00:00Z Last Updated: 2024-09-17T01:56:57.833Z Vendors: Atlassian Products: Bitbucket Server Problem Types: Argument Injection Description: The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them to gain code execution, exploit CVE-2017-1000117 if a vulnerable version of git is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter.