Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7534 State: PUBLISHED Published: 2018-04-11T19:00:00Z Last Updated: 2024-08-05T16:04:11.828Z Vendors: Red Hat, Inc. Products: Openshift Problem Types: CWE-79 Description: OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103754 - https://bugzilla.redhat.com/show_bug.cgi?id=1443003
CVE ID: CVE-2017-7535 State: PUBLISHED Published: 2018-07-26T13:00:00 Last Updated: 2024-08-05T16:04:11.865Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Foreman Products: foreman Problem Types: CWE-79 Description: foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action. Additional Analyst Notes: - CVE Program Container: References: - https://projects.theforeman.org/issues/20963 - http://www.securityfocus.com/bid/99604 - http://seclists.org/oss-sec
s: - https://projects.theforeman.org/issues/20963 - http://www.securityfocus.com/bid/99604 - http://seclists.org/oss-sec/2017/q3/521 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7535
CVE ID: CVE-2017-7536 State: PUBLISHED Published: 2018-01-10T15:00:00Z Last Updated: 2024-09-16T17:32:38.135Z Vendors: Red Hat, Inc. Products: hibernate-validator Problem Types: CWE-592 Description: In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue(). Addit
ble to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue(). Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2809 - https://access.redhat.com/errata/RHSA-2018:3817 - https://access.redhat.com/errata/RHSA-2018:2740 - https://access.redhat.com/errata/RHSA-2017:2810 - https://access.redhat.com/errata/RHSA-2018:2741 - http://www.securitytracker.com/id/1039744 - https://access.redhat.com/errata/RHSA-2018:2742 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2017:2808 - http://www.securityfocus.com/bid/101048 - https://access.redhat.com/errata/R
//access.redhat.com/errata/RHSA-2017:2808 - http://www.securityfocus.com/bid/101048 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2018:2927 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2018:2743 - https://access.redhat.com/errata/RHSA-2017:3454 - https://access.redhat.com/errata/RHSA-2017:3141 - https://access.redhat.com/errata/RHSA-2017:2811 - https://bugzilla.redhat.com/show_bug.cgi?id=1465573 - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2017-7537 State: PUBLISHED Published: 2018-07-26T13:00:00 Last Updated: 2024-08-05T16:04:11.958Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Dogtag PKI Products: pki-core Problem Types: CWE-592 Description: It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9 - https://access.redhat.com
rogram Container: References: - https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9 - https://access.redhat.com/errata/RHSA-2017:2335 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7537
CVE ID: CVE-2017-7538 State: PUBLISHED Published: 2018-07-26T15:00:00 Last Updated: 2024-08-05T16:04:11.974Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Satellite Problem Types: CWE-79 Description: A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7538 - http://www.securitytracker.com/id/1039267 - https://access.redhat.com/errata/RHSA-2017:2
show_bug.cgi?id=CVE-2017-7538 - http://www.securitytracker.com/id/1039267 - https://access.redhat.com/errata/RHSA-2017:2645
CVE ID: CVE-2017-7539 State: PUBLISHED Published: 2018-07-26T14:00:00 Last Updated: 2024-08-05T16:04:11.890Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: QEMU Products: Qemu Problem Types: CWE-617 Description: An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://
emu-nbd server resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2628 - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=2b0bbc4f8809c972bad134bc1a2570dbb01dea0b - https://access.redhat.com/errata/RHSA-2017:3473 - https://access.redhat.com/errata/RHSA-2017:3470 - https://access.redhat.com/errata/RHSA-2017:3472 - https://access.redhat.com/errata/RHSA-2017:3474 - https://access.redhat.com/errata/RHSA-2017:3471 - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=ff82911cd3f69f028f2537825c9720ff78bc3f19 - http://www.openwall.com/lists/oss-security/2017/07/21/4 - https://access.redhat.com/errata/RHSA-20
7825c9720ff78bc3f19 - http://www.openwall.com/lists/oss-security/2017/07/21/4 - https://access.redhat.com/errata/RHSA-2017:3466 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7539 - http://www.securityfocus.com/bid/99944
CVE ID: CVE-2017-7540 State: PUBLISHED Published: 2017-07-21T22:00:00Z Last Updated: 2024-08-05T16:04:11.899Z Vendors: Red Hat, Inc. Products: rubygem-safemode Problem Types: CWE-184 Description: rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svenfuchs/safemode/pull/23
CVE ID: CVE-2017-7541 State: PUBLISHED Published: 2017-07-25T04:00:00 Last Updated: 2024-08-05T16:04:11.990Z Vendors: n/a Products: Linux kernel before 4.12.3 Problem Types: memory corruption Description: The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3927 - https://github.com/torvalds/linux/commit/8f44c9a41386729fea410e688959ddaa9d51be7c - http://
org/security/2017/dsa-3927 - https://github.com/torvalds/linux/commit/8f44c9a41386729fea410e688959ddaa9d51be7c - http://www.securityfocus.com/bid/99955 - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHSA-2017:2931 - https://source.android.com/security/bulletin/2017-11-01 - https://bugzilla.redhat.com/show_bug.cgi?id=1473198 - https://access.redhat.com/errata/RHSA-2017:2863 - http://www.securitytracker.com/id/1038981 - https://bugzilla.novell.com/show_bug.cgi?id=1049645 - http://www.debian.org/security/2017/dsa-3945 - https://www.spinics.net/lists/stable/msg180994.html - http://openwall.com/lists/oss-security/2017/07/24/2 - http://www.kernel.org/pub/linux
.net/lists/stable/msg180994.html - http://openwall.com/lists/oss-security/2017/07/24/2 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.3 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f44c9a41386729fea410e688959ddaa9d51be7c - https://access.redhat.com/errata/RHSA-2017:2930
CVE ID: CVE-2017-7542 State: PUBLISHED Published: 2017-07-21T16:00:00 Last Updated: 2024-08-05T16:04:11.869Z Vendors: n/a Products: Linux kernel versions up to and including 4.12 Problem Types: CWE-190 Description: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3927 - https://access.redhat.com/errata/RHSA-2018:0169 - https://usn.ubuntu.com/3583-2/ - https://access.redhat.com/errata/RHSA-2017:2918 - https://acces
errata/RHSA-2018:0169 - https://usn.ubuntu.com/3583-2/ - https://access.redhat.com/errata/RHSA-2017:2918 - https://access.redhat.com/errata/RHSA-2017:2931 - http://www.securityfocus.com/bid/99953 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://usn.ubuntu.com/3583-1/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6 - http://www.debian.org/security/2017/dsa-3945 - https://github.com/torvalds/linux/commit/6399f1fae4ec29fab5ec76070435555e256ca3a6 - https://access.redhat.com/errata/RHSA-2017:2930
CVE ID: CVE-2017-7543 State: PUBLISHED Published: 2018-07-26T14:00:00 Last Updated: 2024-08-05T16:04:11.998Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: openstack-neutron Problem Types: CWE-362 Description: A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access ex
net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543 - https://access.redhat.com/errata/RHSA-2017:2447 - https://access.redhat.com/errata/RHSA-2017:2451 - https://access.redhat.com/errata/RHSA-2017:2450 - https://access.redhat.com/errata/RHSA-2017:2448 - http://www.securityfocus.com/bid/100237 - https://access.redhat.com/errata/RHSA-2017:2452 - https://access.redhat.com/errata/RHSA-2017:2449
CVE ID: CVE-2017-7544 State: PUBLISHED Published: 2017-09-21T20:00:00Z Last Updated: 2024-08-05T16:04:12.004Z Vendors: Red Hat, Inc. Products: libexif Problem Types: CWE-125 Description: libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/libexif/bugs/130/ - https://usn.ubuntu.com/4277-1/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html - http://li
s/130/ - https://usn.ubuntu.com/4277-1/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
CVE ID: CVE-2017-7545 State: PUBLISHED Published: 2018-07-26T15:00:00 Last Updated: 2024-08-05T16:04:11.884Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: KIE Products: jbpm-designer Problem Types: CWE-611 Description: It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102179 - https://acce
Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102179 - https://access.redhat.com/errata/RHSA-2017:3355 - https://github.com/kiegroup/jbpm-designer/commit/a143f3b92a6a5a527d929d68c02a0c5d914ab81d - https://access.redhat.com/errata/RHSA-2017:3354 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7545
CVE ID: CVE-2017-7546 State: PUBLISHED Published: 2017-08-16T18:00:00Z Last Updated: 2024-09-16T17:18:53.123Z Vendors: PostgreSQL Products: postgresql Problem Types: CWE-287 Description: PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2728 - http://www.debian.org/security/2017/dsa-3936 - https://access.redhat.com/errata/RHSA-2017:2678 - https://access.redhat.com/errata/RHSA-2017:2860 - http://www.securityfocus.com/bid/100278 - http://w
ta/RHSA-2017:2678 - https://access.redhat.com/errata/RHSA-2017:2860 - http://www.securityfocus.com/bid/100278 - http://www.debian.org/security/2017/dsa-3935 - http://www.securitytracker.com/id/1039142 - https://www.postgresql.org/about/news/1772/ - https://security.gentoo.org/glsa/201710-06 - https://access.redhat.com/errata/RHSA-2017:2677
CVE ID: CVE-2017-7547 State: PUBLISHED Published: 2017-08-16T18:00:00Z Last Updated: 2024-09-16T23:41:38.650Z Vendors: PostgreSQL Products: postgresql Problem Types: CWE-522 Description: PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2728 - http://www.debian.org/security/2017/dsa-3936 - https://access.redhat.com/errata/RHSA-2017:2678 - http://www.debian.org/secu
p://www.debian.org/security/2017/dsa-3936 - https://access.redhat.com/errata/RHSA-2017:2678 - http://www.debian.org/security/2017/dsa-3935 - http://www.securitytracker.com/id/1039142 - https://www.postgresql.org/about/news/1772/ - https://security.gentoo.org/glsa/201710-06 - http://www.securityfocus.com/bid/100275 - https://access.redhat.com/errata/RHSA-2017:2677
CVE ID: CVE-2017-7548 State: PUBLISHED Published: 2017-08-16T18:00:00Z Last Updated: 2024-09-16T16:18:38.892Z Vendors: PostgreSQL Products: postgresql Problem Types: CWE-862 Description: PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3936 - https://access.redhat.com/errata/RHSA-2017:2678 - http://www.debian.org/security/2017/dsa-3935 - http://www.securitytracker.com/id/1039142 - https://www.p
HSA-2017:2678 - http://www.debian.org/security/2017/dsa-3935 - http://www.securitytracker.com/id/1039142 - https://www.postgresql.org/about/news/1772/ - http://www.securityfocus.com/bid/100276 - https://security.gentoo.org/glsa/201710-06 - https://access.redhat.com/errata/RHSA-2017:2677
CVE ID: CVE-2017-7549 State: PUBLISHED Published: 2017-09-21T20:00:00Z Last Updated: 2024-08-05T16:04:12.059Z Vendors: Red Hat, Inc. Products: instack-undercloud Problem Types: CWE-377 Description: A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/
s of arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2726 - http://www.securityfocus.com/bid/100407 - https://access.redhat.com/errata/RHSA-2017:2649 - https://access.redhat.com/errata/RHSA-2017:2687 - https://access.redhat.com/errata/RHSA-2017:2557 - https://access.redhat.com/errata/RHSA-2017:2693 - https://bugzilla.redhat.com/show_bug.cgi?id=1477403
CVE ID: CVE-2017-7550 State: PUBLISHED Published: 2017-11-21T17:00:00Z Last Updated: 2024-08-05T16:04:12.039Z Vendors: Red Hat, Inc. Products: ansible Problem Types: CWE-532 Description: A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1473645 - https://github.com/ansible/a
CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1473645 - https://github.com/ansible/ansible/issues/30874 - https://access.redhat.com/errata/RHSA-2017:2966
CVE ID: CVE-2017-7551 State: PUBLISHED Published: 2017-08-16T18:00:00Z Last Updated: 2024-08-05T16:04:11.925Z Vendors: 389 Directory Server Products: 389-ds-base Problem Types: CWE-209 Description: 389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2569 - https://pagure.io/389-ds-base/issue/49336
CVE ID: CVE-2017-7552 State: PUBLISHED Published: 2017-09-28T20:00:00 Last Updated: 2024-08-05T16:04:11.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be executed as well as created. An attacker could use this flaw to compromise other users or teams projects stored in source control management of the RHMAP Core installation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2674 - https://access.redhat.com/errata/RHSA-2017:2675 - https://bugzilla.redhat.com/show_bug.cgi?id=1477797
CVE ID: CVE-2017-7553 State: PUBLISHED Published: 2017-09-28T20:00:00 Last Updated: 2024-08-05T16:04:12.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2674 - https://access.redhat.com/errata/RHSA-2017:2675 - https://bugzilla.redhat.com/show_bug.cgi?id=1478792
CVE ID: CVE-2017-7554 State: PUBLISHED Published: 2017-09-28T20:00:00 Last Updated: 2024-08-05T16:04:12.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a stored XSS attack on an application administrator using App Studio. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2674 - https://access.redhat.com/errata/RHSA-2017:2675 - https://bugzilla.redhat.com/show_bug.cgi?id=1478770
CVE ID: CVE-2017-7555 State: PUBLISHED Published: 2017-08-17T19:00:00Z Last Updated: 2024-09-17T02:36:08.138Z Vendors: Red Hat, Inc. Products: augeas Problem Types: CWE-122 Description: Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2017-7555 - http://www.securityfocus.com/bid/100378 - https://access.redhat.com/errata/RHSA-2017:2788 - https://github
e-2017-7555 - http://www.securityfocus.com/bid/100378 - https://access.redhat.com/errata/RHSA-2017:2788 - https://github.com/hercules-team/augeas/pull/480 - http://www.debian.org/security/2017/dsa-3949 - https://access.redhat.com/errata/RHSA-2019:2403
CVE ID: CVE-2017-7556 State: PUBLISHED Published: 2017-08-17T19:00:00Z Last Updated: 2024-08-05T16:04:12.050Z Vendors: Red Hat, Inc. Products: hawtio Problem Types: CWE-352 Description: Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1480060 - http://www.securityfocus.com/bid/100411
CVE ID: CVE-2017-7557 State: PUBLISHED Published: 2017-08-22T14:00:00Z Last Updated: 2024-09-16T18:19:26.001Z Vendors: Red Hat, Inc. Products: dnsdist Problem Types: CWE-287 Description: dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2017-02.html - http://www.securityfocus.com/bid/100508
CVE ID: CVE-2017-7558 State: PUBLISHED Published: 2018-07-26T15:00:00 Last Updated: 2024-08-05T16:04:12.011Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux Products: kernel Problem Types: CWE-125 Description: A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace. Additional Analyst Notes: - CVE Program Container