Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
19-10126 - https://www.debian.org/security/2019/dsa-4465 - https://lists.debian.org/debian-lts-announce/2019/06/msg00010.html - https://lists.debian.org/debian-lts-announce/2019/06/msg00011.html - https://seclists.org/bugtraq/2019/Jun/26 - http://www.securityfocus.com/bid/108817 - https://support.f5.com/csp/article/K95593121 - https://security.netapp.com/advisory/ntap-20190710-0002/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html - https://seclists.org/bugtraq/2019/Jul/33 - http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https:
33 - http://packetstormsecurity.com/files/153702/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://usn.ubuntu.com/4093-1/ - https://usn.ubuntu.com/4094-1/ - https://usn.ubuntu.com/4095-2/ - https://usn.ubuntu.com/4095-1/ - http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html - https://usn.ubuntu.com/4117-1/ - https://usn.ubuntu.com/4118-1/ - https://access.redhat.com/errata/RHSA-2019:3076 - https://access.redhat.com/errata/RHSA-2019:3055 - https://access.redhat.com/errata/RHSA-2019:3089 - http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html - https://access.redhat.com/errata/RHSA-2019:330
rity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html - https://access.redhat.com/errata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517 - https://access.redhat.com/errata/RHSA-2020:0174 - https://access.redhat.com/errata/RHSA-2020:0204
CVE ID: CVE-2019-10127 State: PUBLISHED Published: 2021-03-19T18:52:27 Last Updated: 2024-08-04T22:10:10.033Z Vendors: n/a Products: postgresql Problem Types: CWE-284 Description: A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary dat
rvice account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files. Additional Analyst Notes: - CVE Program Container: References: - https://www.postgresql.org/about/news/1939/ - https://bugzilla.redhat.com/show_bug.cgi?id=1707098 - https://security.netapp.com/advisory/ntap-20210430-0004/
CVE ID: CVE-2019-10128 State: PUBLISHED Published: 2021-03-19T19:15:11 Last Updated: 2024-08-04T22:10:09.785Z Vendors: n/a Products: postgresql Problem Types: CWE-284 Description: A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an
ess limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.postgresql.org/about/news/1939/ - https://bugzilla.redhat.com/show_bug.cgi?id=1707102 - https://security.netapp.com/advisory/ntap-20210430-0004/
CVE ID: CVE-2019-10129 State: PUBLISHED Published: 2019-07-30T16:10:04 Last Updated: 2024-08-04T22:10:09.985Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: PostgreSQL Project Products: postgresql Problem Types: CWE-125 Description: A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as for CVE-2018-1052). Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/
s for CVE-2018-1052). Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202003-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10129 - https://www.postgresql.org/about/news/1939/
CVE ID: CVE-2019-10130 State: PUBLISHED Published: 2019-07-30T16:13:46 Last Updated: 2024-08-04T22:10:09.927Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: PostgreSQL Project Products: postgresql Problem Types: CWE-284 Description: A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning;
he column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.postgresql.org/about/news/1939/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10130 - https://security.gentoo.org/glsa/202003-03 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
CVE ID: CVE-2019-10131 State: PUBLISHED Published: 2019-04-30T18:01:57 Last Updated: 2024-08-04T22:10:10.025Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-193 Description: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10131 - https://github.com/ImageMagick/ImageMagick/commit/cb1214c124e1bd61f7dd551
la.redhat.com/show_bug.cgi?id=CVE-2019-10131 - https://github.com/ImageMagick/ImageMagick/commit/cb1214c124e1bd61f7dd551b94a794864861592e - http://www.securityfocus.com/bid/108117 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00051.html - https://usn.ubuntu.com/4034-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00001.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2019-10132 State: PUBLISHED Published: 2019-05-22T17:21:19 Last Updated: 2024-08-04T22:10:09.957Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: libvirt Products: libvirt Problem Types: CWE-732 Description: A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. Additional Analyst Notes: - CVE Program Container: References: - https://security.libvirt.org/2019/0003.html - https://b
Additional Analyst Notes: - CVE Program Container: References: - https://security.libvirt.org/2019/0003.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10132 - https://access.redhat.com/errata/RHSA-2019:1264 - https://access.redhat.com/errata/RHSA-2019:1268 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5RANC4LWZQRVJGJHVWCU6R4CCXQMDD4L/ - https://access.redhat.com/errata/RHSA-2019:1455 - https://usn.ubuntu.com/4021-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYMNKXAUBZCFBBPFH64FJPH5EJH4GSU2/
CVE ID: CVE-2019-10133 State: PUBLISHED Published: 2019-06-26T18:10:34 Last Updated: 2024-08-04T22:10:09.989Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Moodle Products: moodle Problem Types: CWE-601 Description: A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10133 - https://moodle.org/mod/forum/discuss.php?d=386523
CVE ID: CVE-2019-10134 State: PUBLISHED Published: 2019-06-26T18:14:38 Last Updated: 2024-08-04T22:10:10.031Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Moodle Products: moodle Problem Types: CWE-20 Description: A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10134 - https://moodle.org/mod/forum/discuss.php?d=386524
CVE ID: CVE-2019-10135 State: PUBLISHED Published: 2019-07-11T00:00:00 Last Updated: 2024-08-04T22:10:09.963Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: osbs-client Problem Types: CWE-502 Description: A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function allowed the user to load any suspicious object for code execution via the parsing of malicious YAML files. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10135 - https://github.com/containerbuildsystem/osbs-client/pull/865
CVE ID: CVE-2019-10136 State: PUBLISHED Published: 2019-07-02T19:29:42 Last Updated: 2024-08-04T22:10:09.975Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: spacewalkproject Products: spacewalk Problem Types: CWE-347 Description: It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10136 - http://www.securityfocus.com/bid
m Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10136 - http://www.securityfocus.com/bid/109029
CVE ID: CVE-2019-10137 State: PUBLISHED Published: 2019-07-02T19:28:32 Last Updated: 2024-08-04T22:10:10.032Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: spacewalkproject Products: spacewalk-proxy Problem Types: CWE-22 Description: A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitrary code in the context of the httpd process. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.c
context of the httpd process. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10137
CVE ID: CVE-2019-10138 State: PUBLISHED Published: 2019-07-30T16:16:51 Last Updated: 2024-08-04T22:10:10.017Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: python-novajoin Problem Types: CWE-284 Description: A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138 - https://review.opendev.org/#/c/631240/
CVE ID: CVE-2019-10139 State: PUBLISHED Published: 2019-05-17T15:28:59 Last Updated: 2024-08-04T22:10:10.077Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: ovirt Products: cockpit-ovirt Problem Types: CWE-522 Description: During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139 - http://www.securityfocus.com
ogram Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139 - http://www.securityfocus.com/bid/108396 - https://access.redhat.com/errata/RHSA-2019:2433 - https://access.redhat.com/errata/RHSA-2019:2437
CVE ID: CVE-2019-10140 State: PUBLISHED Published: 2019-08-15T16:50:55 Last Updated: 2024-08-04T22:10:09.983Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenSource Products: kernel: Problem Types: CWE-476 Description: A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References:
to crash the kernel creating a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10140 - https://security.netapp.com/advisory/ntap-20190905-0002/
CVE ID: CVE-2019-10141 State: PUBLISHED Published: 2019-07-30T16:22:59 Last Updated: 2024-08-04T22:10:09.963Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: RedHat Products: openstack-ironic-inspector Problem Types: CWE-89 Description: A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker
by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://docs.openstack.org/releasenotes/ironic-inspector/rocky.html#relnotes-8-0-3-stable-rocky - https://docs.openstack.org/releasenotes/ironic-inspector/stein.html#relnotes-8-2-1-stable-stein - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10141 - https://doc
pector/stein.html#relnotes-8-2-1-stable-stein - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10141 - https://docs.openstack.org/releasenotes/ironic-inspector/ocata.html#relnotes-5-0-2-7-origin-stable-ocata - https://docs.openstack.org/releasenotes/ironic-inspector/pike.html#relnotes-6-0-3-4-stable-pike - https://docs.openstack.org/releasenotes/ironic-inspector/queens.html#relnotes-7-2-4-stable-queens - https://access.redhat.com/errata/RHSA-2019:2505
CVE ID: CVE-2019-10142 State: PUBLISHED Published: 2019-07-30T16:26:31 Last Updated: 2024-08-04T22:10:10.016Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: RedHat Products: kernel Problem Types: CWE-190, CWE-119 Description: A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system, corrupt memory, or create other adverse security affects. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.r
eate other adverse security affects. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10142
CVE ID: CVE-2019-10143 State: PUBLISHED Published: 2019-05-24T00:00:00 Last Updated: 2024-08-04T22:10:10.031Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: freeradius Products: freeradius Problem Types: CWE-266, CWE-250 Description: It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges
e radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKODLHHUOVAYENTBP4D3N25ST3Q6LJBP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6VKBZAZKJP5QKXDXRKCM2ZPZND3TFAX/ - https://access.redhat.com/errata/RHSA-2019:3353 - http://seclists.org/fulldisclosure/2019/Nov/14 - https://freeradius.org/security/ - http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19
isclosure/2019/Nov/14 - https://freeradius.org/security/ - http://packetstormsecurity.com/files/155361/FreeRadius-3.0.19-Logrotate-Privilege-Escalation.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10143 - https://github.com/FreeRADIUS/freeradius-server/pull/2666
CVE ID: CVE-2019-10144 State: PUBLISHED Published: 2019-06-03T18:19:20 Last Updated: 2024-08-04T22:10:10.029Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: rkt Problem Types: CWE-250 Description: rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/ - https://
Program Container: References: - https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10144
CVE ID: CVE-2019-10145 State: PUBLISHED Published: 2019-06-03T18:20:07 Last Updated: 2024-08-04T22:10:09.975Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: rkt Problem Types: CWE-250 Description: rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10145 - https://www.twistlock.
CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10145 - https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/
CVE ID: CVE-2019-10146 State: PUBLISHED Published: 2020-03-18T14:47:30 Last Updated: 2024-08-04T22:10:09.971Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: pki-core Problem Types: CWE-79 Description: A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10146
CVE ID: CVE-2019-10147 State: PUBLISHED Published: 2019-06-03T18:21:04 Last Updated: 2024-08-04T22:10:10.003Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: rkt Problem Types: CWE-250 Description: rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/ - http
CVE Program Container: References: - https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10147
CVE ID: CVE-2019-10148 State: REJECTED Published: 2020-04-20T19:27:42 Last Updated: 2020-04-20T19:27:42 Description: No description available.
CVE ID: CVE-2019-10149 State: PUBLISHED Published: 2019-06-05T00:00:00.000Z Last Updated: 2025-10-21T23:45:35.245Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: exim Products: exim Problem Types: CWE-78 Description: A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.openwall.com/lists/oss-security/2019/06/05/2 - https://usn.ubuntu.com/4010-1/ - http://www.openwall.com/lists/oss-security/2019/06/05/3 - http://www.openwall.co
05/2 - https://usn.ubuntu.com/4010-1/ - http://www.openwall.com/lists/oss-security/2019/06/05/3 - http://www.openwall.com/lists/oss-security/2019/06/05/4 - https://www.debian.org/security/2019/dsa-4456 - https://seclists.org/bugtraq/2019/Jun/5 - https://security.gentoo.org/glsa/201906-01 - http://www.openwall.com/lists/oss-security/2019/06/06/1 - http://www.securityfocus.com/bid/108679 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html - http://seclists.org/fulldisclosure/2019/Jun/16 - http://www.openwall.com/lists/oss-security/2019/07/25/6 - http://www.openwall.com/lists/oss-security/2019/07/25/7 - http://www.openwall.com/lists/oss-security/2019/07/26/4 - http://ww