Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12422 State: PUBLISHED Published: 2019-11-18T22:04:21 Last Updated: 2024-08-04T23:17:39.997Z Vendors: Apache Products: Shiro Problem Types: Weak Cookie Vulnerability Description: Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E - https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E
CVE ID: CVE-2019-12423 State: PUBLISHED Published: 2020-01-16T17:42:14 Last Updated: 2024-08-04T23:17:40.033Z Vendors: Apache Products: CXF Problem Types: Information Disclosure Description: Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security
ver it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all. Additional Analyst Notes: - CVE Program
ted by default. "oct" keys, which contain secret keys, are not returned at all. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd588ff96f18563aeb5f87ac8c6bce7aae86cb1a4d4be483f96e7208c%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - http://cxf.apache.org/security-advisories.data/CVE-2019-12423.txt.asc?version=1&modificationDate=1579178393000&api=v2
- http://cxf.apache.org/security-advisories.data/CVE-2019-12423.txt.asc?version=1&modificationDate=1579178393000&api=v2 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2019-12424 State: REJECTED Published: 2019-12-09T17:24:21 Last Updated: 2019-12-09T17:24:21 Description: No description available.
CVE ID: CVE-2019-12425 State: PUBLISHED Published: 2020-04-30T19:20:11 Last Updated: 2024-08-04T23:17:40.005Z Vendors: Apache Products: Apache OFBiz Problem Types: CSRF Vulnerability Description: Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/7sr1x - https://lists.apache.org/thread.html/r5181b36218225447d3ce70891eeccfb6d6885309dffd7e0e59091817%40%3Cuser.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r907ce90745b52d2d5b6a815de03fd1d5f3831ab579a81d70cfda6f3d%40%3Cuser.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313ad
1ab579a81d70cfda6f3d%40%3Cuser.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r0a0a701610b3bcdf14634047313adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E
CVE ID: CVE-2019-12426 State: PUBLISHED Published: 2020-02-06T16:47:14 Last Updated: 2024-08-04T23:17:40.123Z Vendors: Apache Products: Apache OFBiz Problem Types: Information Disclosure Description: an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06 Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/w0dem - https://lists.apache.org/thread.html/r40a3c0930f7945e97e30c25422f52dbe476d5584346c3de5c556c272%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz.apache.org%3E - https
pache.org/thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz.apache.org%3E - https://lists.apache.org/thread.html/r034123f2767830169fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E
CVE ID: CVE-2019-12427 State: PUBLISHED Published: 2020-01-27T18:21:57 Last Updated: 2024-08-04T23:17:40.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://bugzilla.zimbra.com/show_bug.cgi?id=109174
CVE ID: CVE-2019-12428 State: PUBLISHED Published: 2020-03-10T13:08:16 Last Updated: 2024-08-04T23:17:40.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12429 State: PUBLISHED Published: 2020-03-10T13:10:16 Last Updated: 2024-08-04T23:17:40.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request counts of confidential issues via the milestone details page. It has Improper Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12430 State: PUBLISHED Published: 2020-03-10T13:40:00 Last Updated: 2024-08-04T23:17:40.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12431 State: PUBLISHED Published: 2020-03-10T13:41:50 Last Updated: 2024-08-04T23:17:40.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through the Search API. It has Improper Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12432 State: PUBLISHED Published: 2020-03-10T13:43:24 Last Updated: 2024-08-04T23:17:40.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the title of confidential issues through the unsubscription page. It allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12433 State: PUBLISHED Published: 2020-03-10T13:45:50 Last Updated: 2024-08-04T23:17:40.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12434 State: PUBLISHED Published: 2020-03-10T13:48:07 Last Updated: 2024-08-04T23:17:40.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast of the destination URLs of issues linked in comments. It allows Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12435 State: PUBLISHED Published: 2019-06-19T11:56:01 Last Updated: 2024-08-04T23:17:40.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server (dnsserver) RPC server process. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2019-12435.html - https://usn.ubuntu.com/4018-1/ - http://www.securityfocus.com/bid/108825 - https://www.synology.com/security/advisory/Synology_SA_19_27 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
ogy.com/security/advisory/Synology_SA_19_27 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ3LCJNJ3ONHIRKDSKOTT6QGXALLCHVG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSG3TLPZP35RH5DWAIDC7MHXRK5DFKOE/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00023.html
CVE ID: CVE-2019-12436 State: PUBLISHED Published: 2019-06-19T12:00:33 Last Updated: 2024-08-04T23:17:40.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samba 4.10.x before 4.10.5 has a NULL pointer dereference, leading to an AD DC LDAP server Denial of Service. This is related to an attacker using the paged search control. The attacker must have directory read access in order to attempt an exploit. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2019-12436.html - https://usn.ubuntu.com/4018-1/ - http://www.securityfocus.com/bid/108823 - https://www.synology.com/security/advisory/Synology_SA_19_27 - https://lists.fedor
://www.securityfocus.com/bid/108823 - https://www.synology.com/security/advisory/Synology_SA_19_27 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ3LCJNJ3ONHIRKDSKOTT6QGXALLCHVG/
CVE ID: CVE-2019-12437 State: PUBLISHED Published: 2020-02-19T16:28:06 Last Updated: 2024-08-04T23:17:40.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations, Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases
CVE ID: CVE-2019-12439 State: PUBLISHED Published: 2019-05-29T14:42:08 Last Updated: 2024-08-04T23:17:40.131Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AC:H/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectatomic/bubblewrap/issues/304 - https://github.com/projectatomic/bubblewrap/commit/efc89e3b939b
https://github.com/projectatomic/bubblewrap/issues/304 - https://github.com/projectatomic/bubblewrap/commit/efc89e3b939b4bde42c10f065f6b7b02958ed50e - https://bugzilla.redhat.com/show_bug.cgi?id=1695963 - https://github.com/projectatomic/bubblewrap/releases/tag/v0.3.3 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00015.html - https://access.redhat.com/errata/RHSA-2019:1833 - https://security.gentoo.org/glsa/202006-18
CVE ID: CVE-2019-12440 State: PUBLISHED Published: 2019-05-29T15:03:57 Last Updated: 2024-08-04T23:17:40.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service. Additional Analyst Notes: - CVE Program Container: References: - https://kb.sitecore.net/articles/842902 - https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149 - https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a
CVE ID: CVE-2019-12441 State: PUBLISHED Published: 2020-03-10T14:36:45 Last Updated: 2024-08-04T23:17:40.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which resulted in a bypass of the protected branches restriction rules. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12442 State: PUBLISHED Published: 2020-03-10T14:38:37 Last Updated: 2024-08-04T23:17:40.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12443 State: PUBLISHED Published: 2020-03-10T14:41:01 Last Updated: 2024-08-04T23:17:40.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabilities caused by an insufficient validation to prevent DNS rebinding attacks. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12444 State: PUBLISHED Published: 2020-03-10T14:42:32 Last Updated: 2024-08-04T23:17:40.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12445 State: PUBLISHED Published: 2020-03-10T14:45:16 Last Updated: 2024-08-04T23:17:40.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12446 State: PUBLISHED Published: 2020-03-10T14:47:10 Last Updated: 2024-08-04T23:17:40.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/
CVE ID: CVE-2019-12447 State: PUBLISHED Published: 2019-05-29T16:15:29 Last Updated: 2024-08-04T23:17:40.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html - https://usn.ubuntu.com/4053-1/ - http://www.openwall.com/lists/oss-security/2019/07/09/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
all.com/lists/oss-security/2019/07/09/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/ - https://gitlab.gnome.org/GNOME/gvfs/commit/d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80
CVE ID: CVE-2019-12448 State: PUBLISHED Published: 2019-05-29T16:15:57 Last Updated: 2024-08-04T23:17:40.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html - https://usn.ubuntu.com/4053-1/ - http://www.openwall.com/lists/oss-security/2019/07/09/3 - https://lists.fedoraproject.org/archives/lis
ntu.com/4053-1/ - http://www.openwall.com/lists/oss-security/2019/07/09/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/ - https://gitlab.gnome.org/GNOME/gvfs/commit/764e9af7522e3096c0f44613c330377d31c9bbb5
CVE ID: CVE-2019-12449 State: PUBLISHED Published: 2019-05-29T16:16:06 Last Updated: 2024-08-04T23:17:40.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html - https://usn.ubuntu.com/4053-1/ - http://www.
ttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html - https://usn.ubuntu.com/4053-1/ - http://www.openwall.com/lists/oss-security/2019/07/09/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/ - https://gitlab.gnome.org/GNOME/gvfs/commit/409619412e11be146a31b9a99ed965925f1aabb8
CVE ID: CVE-2019-12450 State: PUBLISHED Published: 2019-05-29T16:16:14 Last Updated: 2024-08-04T23:17:40.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174 - https://security.netapp.com/advisory/ntap-20190606-0003/ - https://usn.ubuntu.com/4014-1/ - https://usn.ubuntu.com/4014-2/ - https://lists.fedoraproject.org/archives/list/package-announce%
sn.ubuntu.com/4014-1/ - https://usn.ubuntu.com/4014-2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/ - https://lists.debian.org/debian-lts-announce/2019/06/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.html - https://access.redhat.com/errata/RHSA-2019:3530
CVE ID: CVE-2019-12452 State: PUBLISHED Published: 2019-05-29T18:43:05 Last Updated: 2024-08-04T23:17:40.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS section. These can be found in the JSON response to a /api request. Additional Analyst Notes: - CVE Program Container: References: -
e can be found in the JSON response to a /api request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containous/traefik/issues/4917 - https://github.com/containous/traefik/pull/4918 - https://docs.traefik.io/configuration/api/#security
CVE ID: CVE-2019-12453 State: PUBLISHED Published: 2019-07-19T16:53:47 Last Updated: 2024-08-04T23:17:40.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. Additional Analyst Notes: - CVE Program Container: References: - http://www.microstrategy.com/producthelp/10.10/Readme/content/web.htm - https://github.com/undefinedmode/CVE-2019-12453