Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21987333 - http://www.securitytracker.com/id/1036488
CVE ID: CVE-2016-3060 State: PUBLISHED Published: 2016-10-29T01:00:00 Last Updated: 2024-08-05T23:40:15.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users to conduct clickjacking attacks via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1PI64064 - http://www-01.ibm.com/support/docview.wss?uid=swg1PI64063 - http://www-01.ibm.com/support/docview.wss?uid=swg21989060 - http://www-01.i
bm.com/support/docview.wss?uid=swg1PI64063 - http://www-01.ibm.com/support/docview.wss?uid=swg21989060 - http://www-01.ibm.com/support/docview.wss?uid=swg1PI67537 - http://www.securityfocus.com/bid/92633
CVE ID: CVE-2016-3062 State: PUBLISHED Published: 2016-06-16T18:00:00 Last Updated: 2024-08-05T23:40:15.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-06/msg00105.html - https://security.gentoo.org/glsa/201705-08 - https://git.libav.org/?p=libav.git%3Ba=commit%3Bh=7e01d48cfd168c3dfc663f03a3b6a98e0ecba328 - http://www.debian.o
05-08 - https://git.libav.org/?p=libav.git%3Ba=commit%3Bh=7e01d48cfd168c3dfc663f03a3b6a98e0ecba328 - http://www.debian.org/security/2016/dsa-3603 - https://bugzilla.libav.org/show_bug.cgi?id=929 - https://github.com/FFmpeg/FFmpeg/commit/689e59b7ffed34eba6159dcc78e87133862e3746 - https://libav.org/releases/libav-11.7.changelog - https://ffmpeg.org/security.html
CVE ID: CVE-2016-3063 State: PUBLISHED Published: 2017-02-07T17:00:00 Last Updated: 2024-08-05T23:40:15.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execute arbitrary API calls via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/s/article/cve-2016-3063-zapi-injection-vulnerability-in-oncommand-system-manager - https://security.netapp.com/advisory/ntap-20160310-0004/
CVE ID: CVE-2016-3064 State: PUBLISHED Published: 2016-09-01T01:00:00 Last Updated: 2024-08-05T23:40:15.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Clustered Data ONTAP before 8.2.4P4 and 8.3.x before 8.3.2P2 allows remote authenticated users to obtain sensitive cluster and tenant information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20160830-0002/ - http://kb.netapp.com/support/index?page=content&id=9010099 - http://www.securityfocus.com/bid/92686
CVE ID: CVE-2016-3065 State: PUBLISHED Published: 2016-04-11T15:00:00 Last Updated: 2024-08-05T23:40:15.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page. Additional Analyst Notes: - CVE Program Container: References: - http://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=bf78a6f107949fdfb513d1b45e30cefe04e09e4f - http://www.postgr
.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=bf78a6f107949fdfb513d1b45e30cefe04e09e4f - http://www.postgresql.org/docs/current/static/release-9-5-2.html - http://www.postgresql.org/about/news/1656/ - http://www.securitytracker.com/id/1035468
CVE ID: CVE-2016-3066 State: PUBLISHED Published: 2017-06-06T18:00:00 Last Updated: 2024-08-05T23:40:15.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1320263
CVE ID: CVE-2016-3067 State: PUBLISHED Published: 2017-04-21T20:00:00 Last Updated: 2024-08-05T23:40:15.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cygwin.com/ml/cygwin-announce/2016-04/msg00020.html - https://cygwin.com/ml/cygwin-announce/2016-04/msg00054.html - https://cygwin.com/ml/cygwin/2016-02/msg00129.html - https://cygwin.com/ml/cygwin-announce/2016-02/msg00023.html - https://sourceware.org/git/?p=newlib-cygwin.git%3Ba=commit%3Bh=205862ed08649df8f50b926a2c58c963f57
16-02/msg00023.html - https://sourceware.org/git/?p=newlib-cygwin.git%3Ba=commit%3Bh=205862ed08649df8f50b926a2c58c963f571b044
CVE ID: CVE-2016-3068 State: PUBLISHED Published: 2016-04-13T16:00:00 Last Updated: 2024-08-05T23:40:15.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html - https://security.gentoo.org/glsa/201612-19 - http://www.debian.org/security/2016/dsa-3542 - https://selenic.com/repo/hg-stable/rev/34d43cb85de8 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://lists.opensuse
d43cb85de8 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html - http://rhn.redhat.com/errata/RHSA-2016-0706.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html - http://www.securityfocus.com/bid/85733 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html - http://lists.opensuse.org/opensuse-s
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html
CVE ID: CVE-2016-3069 State: PUBLISHED Published: 2016-04-13T16:00:00 Last Updated: 2024-08-05T23:40:15.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html - https://security.gentoo.org/glsa/201612-19 - http://www.debian.org/security/2016/dsa-3542 - https://selenic.com/repo/hg-stable/rev/b732e7f2aba4 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - https://selenic.com/repo/h
2aba4 - http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html - https://selenic.com/repo/hg-stable/rev/197eed39e3d5 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html - https://selenic.com/repo/hg-stable/rev/cdda7b96afff - http://rhn.redhat.com/errata/RHSA-2016-0706.html - https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29 - http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html - https://selenic.com/repo/hg-stable/rev/80cac1de6aea - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html - htt
curity-announce/2016-04/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html - https://selenic.com/repo/hg-stable/rev/ae279d4a19e9 - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html
CVE ID: CVE-2016-3070 State: PUBLISHED Published: 2016-08-06T20:00:00 Last Updated: 2024-08-05T23:40:15.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-3035-3 - http://www.ubuntu.com/usn/USN-3035-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1308846 - http://
om/usn/USN-3035-3 - http://www.ubuntu.com/usn/USN-3035-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1308846 - http://www.ubuntu.com/usn/USN-3036-1 - http://rhn.redhat.com/errata/RHSA-2016-2584.html - http://www.ubuntu.com/usn/USN-3035-2 - http://rhn.redhat.com/errata/RHSA-2016-2574.html - https://github.com/torvalds/linux/commit/42cb14b110a5698ccf26ce59c4441722605a3743 - http://www.ubuntu.com/usn/USN-3037-1 - http://www.debian.org/security/2016/dsa-3607 - https://security-tracker.debian.org/tracker/CVE-2016-3070 - http://www.ubuntu.com/usn/USN-3034-1 - http://www.securityfocus.com/bid/90518 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=42cb14b110a5698ccf26ce5
yfocus.com/bid/90518 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=42cb14b110a5698ccf26ce59c4441722605a3743 - http://www.ubuntu.com/usn/USN-3034-2
CVE ID: CVE-2016-3071 State: PUBLISHED Published: 2016-04-18T14:00:00 Last Updated: 2024-08-05T23:40:15.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182130.html - http://www.securityfocus.com/bid/87295 - http://download.libreswan.org/CHANGES - https://libreswan.org/security/CVE-2016-3071/CVE-2016-3071.txt - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182050.html
CVE ID: CVE-2016-3072 State: PUBLISHED Published: 2016-06-07T18:00:00 Last Updated: 2024-08-05T23:40:15.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:1083 - https://bugzilla.redhat.com/show_bug.cgi?id=1322050 - https://github.com/Katello/katello/pull/6051
CVE ID: CVE-2016-3073 State: REJECTED Published: 2017-06-01T21:00:00 Last Updated: 2017-06-01T20:57:01 Description: No description available.
CVE ID: CVE-2016-3074 State: PUBLISHED Published: 2016-04-26T14:00:00 Last Updated: 2024-08-05T23:40:15.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3556 - https://www.exploit-db.com/exploits/39736/ - https://security.gentoo.org/glsa/201611-22 - http://www.securityfocus.com/bid/87087 - http://rhn.redhat.com/errata/RHSA-20
tps://security.gentoo.org/glsa/201611-22 - http://www.securityfocus.com/bid/87087 - http://rhn.redhat.com/errata/RHSA-2016-2750.html - http://seclists.org/fulldisclosure/2016/Apr/72 - http://www.debian.org/security/2016/dsa-3602 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183724.html - http://www.securitytracker.com/id/1035659 - https://security.gentoo.org/glsa/201607-04 - http://www.ubuntu.com/usn/USN-2987-1 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.383127 - http://packetstormsecurity.com/files/136757/libgd-2.1.1-Signedness.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c052
136757/libgd-2.1.1-Signedness.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731 - http://www.securityfocus.com/archive/1/538160/100/0/threaded - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183263.html - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html - https://github.com/libgd/libgd/commit/2bb97f407c1145c850416a3bfbcc8cf124e68a19
CVE ID: CVE-2016-3075 State: PUBLISHED Published: 2016-06-01T20:00:00 Last Updated: 2024-08-05T23:40:15.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html - http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html - http://www.securityfocus.com/bid/85732 - https://sourceware.org/git/
ensuse.org/opensuse-updates/2016-07/msg00039.html - http://www.securityfocus.com/bid/85732 - https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=317b199b4aff8cfa27f2302ab404d2bb5032b9a4 - https://security.gentoo.org/glsa/201702-11 - http://rhn.redhat.com/errata/RHSA-2016-2573.html - http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html - http://www.ubuntu.com/usn/USN-2985-1 - https://sourceware.org/bugzilla/show_bug.cgi?id=19879
CVE ID: CVE-2016-3076 State: PUBLISHED Published: 2017-04-24T18:00:00 Last Updated: 2024-08-05T23:40:15.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file. Additional Analyst Notes: - CVE Program Container: References: - http://pillow.readthedocs.io/en/4.1.x/releasenotes/3.1.2.html - https://bugzilla.redhat.com/show_bug.cgi?id=1321929 - http://www.securityfocus.com/bid/98042
CVE ID: CVE-2016-3077 State: PUBLISHED Published: 2017-06-06T18:00:00 Last Updated: 2024-08-05T23:40:15.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1321972
CVE ID: CVE-2016-3078 State: PUBLISHED Published: 2016-08-07T10:00:00 Last Updated: 2024-08-05T23:40:15.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=71923 - https://github.com/php/php-src/commit/3b8d4de300854b3517c7acb239b84f7726c1353c?w=1 - http://www.openwall.com/lists/oss
- https://github.com/php/php-src/commit/3b8d4de300854b3517c7acb239b84f7726c1353c?w=1 - http://www.openwall.com/lists/oss-security/2016/04/28/1 - https://security-tracker.debian.org/tracker/CVE-2016-3078 - https://www.exploit-db.com/exploits/39742/ - https://php.net/ChangeLog-7.php - http://www.securitytracker.com/id/1035701
CVE ID: CVE-2016-3079 State: PUBLISHED Published: 2016-04-14T14:00:00 Last Updated: 2024-08-05T23:40:15.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1320444 - http://rhn.redhat.com/errata/RHSA-2016-059
ontainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1320444 - http://rhn.redhat.com/errata/RHSA-2016-0590.html - https://bugzilla.redhat.com/show_bug.cgi?id=1320940 - https://github.com/spacewalkproject/spacewalk/commit/7b9ff9ad - https://github.com/spacewalkproject/spacewalk/commit/b6491eba - https://bugzilla.redhat.com/show_bug.cgi?id=1320452 - https://github.com/spacewalkproject/spacewalk/commit/982b11c9 - https://github.com/spacewalkproject/spacewalk/commit/7920542f
CVE ID: CVE-2016-3080 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-05T23:40:15.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via the (1) RHNMD User or (2) Filesystem parameters, related to display of monitoring probes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1320942 - http://rhn.redhat.com/errata/RHSA-2016-1484.html
CVE ID: CVE-2016-3081 State: PUBLISHED Published: 2016-04-26T14:00:00 Last Updated: 2024-08-05T23:40:15.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035665 - https://struts.apache.org/docs/s2-032.html - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.h
y-advisories/huawei-sa-20160527-01-struts2-en - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec - https://www.exploit-db.com/exploits/39756/ - http://www.securityfocus.com/bid/91787 - http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html - http://www.securityfocus.com/bid/87327 - http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec
CVE ID: CVE-2016-3082 State: PUBLISHED Published: 2016-04-26T14:00:00 Last Updated: 2024-08-05T23:40:15.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/88826 - http://struts.apache.org/docs/s2-031.html - http://www.securitytracker.com/id/1035664
CVE ID: CVE-2016-3083 State: PUBLISHED Published: 2017-05-30T14:00:00 Last Updated: 2024-08-05T23:40:15.584Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: Information Disclosure Description: Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.
an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/0851bcf85635385f94cdaa008053802d92b4aab0a3075e30ed171192%40%3Cdev.hive.apache.org%3E - http://www.securityfocus.com/bid/98669
CVE ID: CVE-2016-3084 State: PUBLISHED Published: 2017-05-25T17:00:00 Last Updated: 2024-08-05T23:40:15.665Z Vendors: Pivotal Products: Cloud Foundry Problem Types: XSS Description: The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected. Additional Analyst Notes:
re for authentication. Deployments enabled for integration via SAML or LDAP are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2016-3084
CVE ID: CVE-2016-3085 State: PUBLISHED Published: 2016-06-10T15:00:00 Last Updated: 2024-08-05T23:40:15.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html - http://www.securityfocus.com/archive/1/538636/100/0/threaded
CVE ID: CVE-2016-3086 State: PUBLISHED Published: 2017-09-05T13:00:00Z Last Updated: 2024-09-16T17:13:54.507Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: Information Disclosure Description: The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95335 - http://mail-archives.apache.org/mod_mbox/hadoop-general/201701.mbox/%3C0ed32746-5a53-9051-5877-2b1abd88beb6%40apache.org%3E