Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-7120 State: PUBLISHED Published: 2019-05-10T18:22:40 Last Updated: 2024-08-05T06:17:17.576Z Vendors: HPE Products: HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy Problem Types: Local or Remote Unauthorized Elevation of Privilege Description: A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of the HPE Synergy Custom SPP 2018.11.20190205, could allow local or remote unauthorized elevation of privilege. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03916en_us
CVE ID: CVE-2018-7121 State: PUBLISHED Published: 2019-06-05T14:09:20 Last Updated: 2024-08-05T06:17:17.395Z Vendors: n/a Products: HPE Intelligent Management Center (IMC) PLAT Problem Types: remote code execution Description: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us
CVE ID: CVE-2018-7122 State: PUBLISHED Published: 2019-06-05T14:09:58 Last Updated: 2024-08-05T06:17:17.564Z Vendors: n/a Products: HPE Intelligent Management Center (IMC) PLAT Problem Types: remote disclosure of Information Description: A remote disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us
CVE ID: CVE-2018-7123 State: PUBLISHED Published: 2019-06-05T14:10:36 Last Updated: 2024-08-05T06:17:17.465Z Vendors: n/a Products: HPE Intelligent Management Center (IMC) PLAT Problem Types: denial of service Description: A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us
CVE ID: CVE-2018-7124 State: PUBLISHED Published: 2019-06-05T14:11:08 Last Updated: 2024-08-05T06:17:17.565Z Vendors: n/a Products: HPE Intelligent Management Center (IMC) PLAT Problem Types: remote code execution Description: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us
CVE ID: CVE-2018-7125 State: PUBLISHED Published: 2019-06-05T14:11:37 Last Updated: 2024-08-05T06:17:17.462Z Vendors: n/a Products: HPE Intelligent Management Center (IMC) PLAT Problem Types: remote code execution Description: A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us
CVE ID: CVE-2018-7126 State: REJECTED Published: 2020-08-17T14:10:15 Last Updated: 2020-08-17T14:10:15 Description: No description available.
CVE ID: CVE-2018-7127 State: REJECTED Published: 2020-08-17T14:10:15 Last Updated: 2020-08-17T14:10:15 Description: No description available.
CVE ID: CVE-2018-7128 State: REJECTED Published: 2020-08-17T14:10:15 Last Updated: 2020-08-17T14:10:15 Description: No description available.
CVE ID: CVE-2018-7129 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7130 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7131 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7132 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7133 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7134 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7135 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7136 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7137 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7138 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7139 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7140 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7141 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7142 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7143 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7144 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7145 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7146 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7147 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7148 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7149 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7150 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7151 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7152 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7153 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7154 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7155 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7156 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7157 State: REJECTED Published: 2020-08-17T14:10:16 Last Updated: 2020-08-17T14:10:16 Description: No description available.
CVE ID: CVE-2018-7158 State: PUBLISHED Published: 2018-05-17T14:00:00Z Last Updated: 2024-09-16T16:48:51.289Z Vendors: The Node.js Project Products: Node.js Problem Types: CWE-185 Description: The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when p
`path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
CVE ID: CVE-2018-7159 State: PUBLISHED Published: 2018-05-17T14:00:00Z Last Updated: 2024-09-17T01:06:04.658Z Vendors: The Node.js Project Products: Node.js Problem Types: CWE-115 Description: The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use
Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ - https://access.redhat.com/errat
: References: - https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ - https://access.redhat.com/errata/RHSA-2019:2258 - https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2018-7160 State: PUBLISHED Published: 2018-05-17T14:00:00Z Last Updated: 2024-09-17T01:35:37.449Z Vendors: The Node.js Project Products: Node.js Problem Types: CWE-350 Description: The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If
wser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com//security-alerts/cpujul2021.html - https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ - https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2018-7161 State: PUBLISHED Published: 2018-06-13T16:00:00Z Last Updated: 2024-09-17T01:06:27.892Z Vendors: The Node.js Project Products: Node.js Problem Types: Denial of Service Description: All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Additional Analyst Notes: - CVE Program Container: References: - h
been addressed by updating the http2 implementation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106363 - https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ - https://security.gentoo.org/glsa/202003-48
CVE ID: CVE-2018-7162 State: PUBLISHED Published: 2018-06-13T16:00:00Z Last Updated: 2024-09-16T19:46:23.920Z Vendors: The Node.js Project Products: Node.js Problem Types: Denial of Service Description: All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2018-secur
dditional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ - http://www.securityfocus.com/bid/104468 - https://security.gentoo.org/glsa/202003-48
CVE ID: CVE-2018-7164 State: PUBLISHED Published: 2018-06-13T16:00:00Z Last Updated: 2024-09-17T00:56:13.228Z Vendors: The Node.js Project Products: Node.js Problem Types: Denial of Service Description: Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfo
reverting to the prior behaviour. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104463 - https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ - https://security.gentoo.org/glsa/202003-48
CVE ID: CVE-2018-7166 State: PUBLISHED Published: 2018-08-21T13:00:00Z Last Updated: 2024-09-17T00:26:00.258Z Vendors: The Node.js Project Products: Node.js Problem Types: CWE-226 Description: In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that m
flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2553 - https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/
CVE ID: CVE-2018-7167 State: PUBLISHED Published: 2018-06-13T16:00:00Z Last Updated: 2024-09-17T02:00:52.959Z Vendors: The Node.js Project Products: Node.js Problem Types: Denial of Service Description: Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable. Additional Analyst Notes: - CVE Program Container: References
All versions of Node.js 10.x (Current) are NOT vulnerable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106363 - https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ - https://security.gentoo.org/glsa/202003-48
CVE ID: CVE-2018-7169 State: PUBLISHED Published: 2018-02-15T19:00:00 Last Updated: 2024-08-05T06:24:10.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of
ectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357 - https://security.gentoo.org/glsa/201805-09
CVE ID: CVE-2018-7170 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T06:24:10.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html - https://security.gentoo.org/glsa/201805-12 - htt
ecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html - https://security.gentoo.org/glsa/201805-12 - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc - https://security.netapp.com/advisory/ntap-20180626-0001/ - http://www.securityfocus.com/archive/1/541824/100/0/threaded - https://bugzilla.redhat.com/show_bug.cgi?id=1550214 - http://support.ntp.org/bin/view/Main/NtpBug3415 - https://www.synology.com/support/security/Synology_SA_18_13 - http://www.securityfocus.com/bid/103194 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
CVE ID: CVE-2018-7171 State: PUBLISHED Published: 2018-03-30T21:00:00 Last Updated: 2024-08-05T06:24:10.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot) in the contentbase parameter to rpc/set_all. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mechanico/sharingIsCaring/blob/master/twonky.py - http://packetstormsecurity.com/files/146938/TwonkyMedia-Server-7.0.11-8.5-Directory-Traversal.html - https://www.exploit-db.com/exploits/44350/
CVE ID: CVE-2018-7172 State: PUBLISHED Published: 2018-02-27T15:00:00 Last Updated: 2024-08-05T06:24:10.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal. Additional Analyst Notes: - CVE Program Container: References: - http://foreversong.cn/archives/1070 - https://github.com/robiso/wondercms/commit/64efdc4fd974c83cedd221b46e7c3854a81650ec - https://www.wondercms.com/whatsnew
CVE ID: CVE-2018-7173 State: PUBLISHED Published: 2018-02-15T21:00:00Z Last Updated: 2024-09-16T16:44:10.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=607
CVE ID: CVE-2018-7174 State: PUBLISHED Published: 2018-02-15T21:00:00Z Last Updated: 2024-09-17T00:21:31.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xpdf 4.00. An infinite loop in XRef::Xref allows an attacker to cause denial of service because loop detection exists only for tables, not streams. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=605
CVE ID: CVE-2018-7175 State: PUBLISHED Published: 2018-02-15T21:00:00Z Last Updated: 2024-09-16T20:52:58.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xpdf 4.00. A NULL pointer dereference in readCodestream allows an attacker to cause denial of service via a JPX image with zero components. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=613
CVE ID: CVE-2018-7176 State: PUBLISHED Published: 2018-02-16T04:00:00 Last Updated: 2024-08-05T06:24:11.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44137/ - https://securitywarrior9.blogspot.in/2018/02/cross-site-request-forgery-front.html
CVE ID: CVE-2018-7177 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:24:10.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44134
CVE ID: CVE-2018-7178 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:24:10.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44136
CVE ID: CVE-2018-7179 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:24:10.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44135
CVE ID: CVE-2018-7180 State: PUBLISHED Published: 2018-02-17T07:00:00 Last Updated: 2024-08-05T06:24:10.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44133
CVE ID: CVE-2018-7182 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T06:24:10.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html - https://security.gentoo.org/glsa/201805-12 - https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc - https://security.netapp.com/advisory/ntap-201806