Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
139ab0fea24aef935b6321581976887df7ad632e9a515dda%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/9b609d4392d886711e694cf40d86f770022baf42a1b1aa97e8244c87%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/72ca514e01cd5f08151e74f9929799b4cbe1b6e9e6cd24faa72ffcc6%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cuser.flink.apache.org%3E
CVE ID: CVE-2018-11769 State: PUBLISHED Published: 2018-08-08T15:00:00Z Last Updated: 2024-09-16T17:59:21.214Z Vendors: Apache Software Foundation Products: Apache CouchDB Problem Types: Remote Code Execution Description: CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allo
configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105046 - https://security.gentoo.org/glsa/201812-06 - https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75%40%3Cdev.couchdb.apache.org%3E - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
r_na-hpesbmu03935en_us - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3JOUCX7LHDV4YWZDQNXT5NTKKRANZQW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5FPHVVU5KMRFKQTJPAM3TBGC7LKCWQS/
CVE ID: CVE-2018-11770 State: PUBLISHED Published: 2018-08-13T00:00:00 Last Updated: 2024-08-05T08:17:09.223Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: Improper Access Control Description: From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driv
other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'. Additional Analyst Notes: - CVE Pro
lone master by changing the default value of 'spark.master.rest.enabled' to 'false'. Additional Analyst Notes: - CVE Program Container: References: - https://spark.apache.org/security.html#CVE-2018-11770 - https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E - http://www.securityfocus.com/bid/105097
CVE ID: CVE-2018-11771 State: PUBLISHED Published: 2018-08-16T15:00:00Z Last Updated: 2024-09-16T22:03:17.708Z Vendors: Apache Software Foundation Products: Apache Commons Compress Problem Types: denial of service vulnerability Description: When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package. Additional Analyst Notes: - CVE Program Container: Refe
service attack against services that use Compress' zip package. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105139 - https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330%40%3Cannounce.apache.org%3E - http://www.securitytracker.com/id/1041503 - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd%40%3Cdev.creadur.apache.org%3E - https://lists.apache.org/thread.html/b907e70bc422905d7962fd18f863f746bf7b4e7ed9da25c148580c61%40%3Cnoti
.apache.org%3E - https://lists.apache.org/thread.html/b907e70bc422905d7962fd18f863f746bf7b4e7ed9da25c148580c61%40%3Cnotifications.commons.apache.org%3E - https://lists.apache.org/thread.html/f28052d04cb8dbaae39bfd3dc8438e58c2a8be306a3f381f4728d7c1%40%3Ccommits.commons.apache.org%3E - https://lists.apache.org/thread.html/f9cdd32af7d73e943452167d15801db39e8130409ebb9efb243b3f41%40%3Ccommits.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/e3eae9e6fc021c4c22dda59a335d21c12eecab480b48115a2f098ef6%40%3Ccommits.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/35f60d6d0407c13c39411038ba1aca71d92595ed7041beff4d07f2ee%40%3Ccommits.tinkerpop.apache.org%3E - https://lists.ap
ad.html/35f60d6d0407c13c39411038ba1aca71d92595ed7041beff4d07f2ee%40%3Ccommits.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/6c79965066c30d4e330e04d911d3761db41b82c89ae38d9a6b37a6f1%40%3Cdev.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/714c6ac1b1b50f8557e7342903ef45f1538a7bc60a0b47d6e48c273d%40%3Ccommits.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/c7954dc1e8fafd7ca1449f078953b419ebf8936e087f235f3bd024be%40%3Ccommits.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/eeecc1669242b28a3777ae13c68b376b0148d589d3d8170340d61120%40%3Cdev.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced
170340d61120%40%3Cdev.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced41eb9a57478f14781c9f7%40%3Cdev.tinkerpop.apache.org%3E - https://lists.apache.org/thread.html/3565494c263dfeb4dcb2a71cb24d09a1ca285cd6ac74edc025a3af8a%40%3Ccommits.tinkerpop.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2018-11772 State: PUBLISHED Published: 2019-07-29T18:32:36 Last Updated: 2024-08-05T08:17:09.112Z Vendors: Apache Products: VCL Problem Types: SQL Injection Description: Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported t
L systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/a468c473b4c418307b9866fe4c613630a2efc46bed53438b6af1f55c%40%3Cdev.vcl.apache.org%3E - https://lists.apache.org/thread.html/ffde9f87d0730ba6d4e1242eda56c1f1d6d0802ee4eda36fc1be3aaa%40%3Cannounce.apache.org%3E
CVE ID: CVE-2018-11773 State: PUBLISHED Published: 2019-07-29T18:11:55 Last Updated: 2024-08-05T08:17:09.198Z Vendors: Apache Products: VCL Problem Types: improper form validation in block allocation management Description: Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgrad
red to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/db71c4edc21ecb834cf20e3ee23ffac5d37f32e7eb67257a413bf878%40%3Cdev.vcl.apache.org%3E - https://lists.apache.org/thread.html/8f3284afbcb4b87ed107dac98603020c23a379c687858b41da763147%40%3Cannounce.apache.org%3E
CVE ID: CVE-2018-11774 State: PUBLISHED Published: 2019-07-29T18:17:50 Last Updated: 2024-08-05T08:17:09.236Z Vendors: Apache Products: VCL Problem Types: SQL Injection Description: Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venu
.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/8f90e00910d1ee3d850e56d87c18cb298a126d10955413d296e47c0c%40%3Cdev.vcl.apache.org%3E - https://lists.apache.org/thread.html/14486ee999650f72c166812290b2d8f851d39266ca31b91b68aebcd6%40%3Cannounce.apache.org%3E
CVE ID: CVE-2018-11775 State: PUBLISHED Published: 2018-09-10T20:00:00Z Last Updated: 2024-09-16T16:23:47.592Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Problem Types: Missing TLS Hostname Verification Description: TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041618 - http://www.securityfocus.com/bid/105335 - https://lists.apache.org/thread.html/2b5c0039197a4949f29e1
er.com/id/1041618 - http://www.securityfocus.com/bid/105335 - https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b%40%3Cdev.activemq.apache.org%3E - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E - https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1%40%3Cdev.activemq.apache.org%3E - https://access.redhat.com/errata/RHSA-2019:3892 - https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9e
- https://access.redhat.com/errata/RHSA-2019:3892 - https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d%40%3Ccommits.activemq.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2021.html - http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announcement.txt - https://lists.debian.org/debian-lts-announce/2021/03/msg00005.html
CVE ID: CVE-2018-11776 State: PUBLISHED Published: 2018-08-22T13:00:00.000Z Last Updated: 2025-10-21T23:45:48.386Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: Remote Code Execution Description: Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. Addition
tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041888 - https://www.exploit-db.com/exploits/45367/ - https://www.exploit-db.com/exploits/45262/ - http://www.securityfocus.com/bid/105125 - http://www.securitytracker.com/id/1041547 - https://www.exploit-db.com/exploits/45260/ - https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/securit
he.org%3E - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://security.netapp.com/advisory/ntap-20181018-0002/ - https://cwiki.apache.org/confluence/display/WW/S2-057 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012 - http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html - https://lgtm.com/blog/apache_struts_CVE-2018-11776 - https://security.netapp.com/advisory/ntap-20180822-0001/ - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt - https://github.com/hook-s3
sory/ntap-20180822-0001/ - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt - https://github.com/hook-s3c/CVE-2018-11776-Python-PoC - http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html
CVE ID: CVE-2018-11777 State: PUBLISHED Published: 2018-11-08T14:00:00 Last Updated: 2024-08-05T08:17:09.136Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: Exposure of Resource to Wrong Sphere Description: In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105886 - https://lists.apache.org/thread.html/963c8e2516405c9b532b4add16c03b2c5db621e0c83e80f45049cbbb%40%3Cdev.hive.apache.org%3E
CVE ID: CVE-2018-11778 State: PUBLISHED Published: 2018-10-05T19:00:00Z Last Updated: 2024-09-17T03:18:51.761Z Vendors: Apache Software Foundation Products: Apache Ranger Problem Types: Overflow Description: UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0 Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger - https://seclists.org/oss-sec/2018/q4/11 - https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.
- https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.org%3E - https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998%40%3Cdev.ranger.apache.org%3E
CVE ID: CVE-2018-11779 State: PUBLISHED Published: 2019-07-25T23:23:01 Last Updated: 2024-08-05T08:17:09.126Z Vendors: Apache Products: Storm Problem Types: CWE-502 Description: In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/3e4f704c4bd9296405a07a0290b8cbb6cbf5046e277efe6d93280a98%40%3Cuser.storm.apache.org%3E
CVE ID: CVE-2018-11780 State: PUBLISHED Published: 2018-09-17T14:00:00Z Last Updated: 2024-09-16T20:57:28.432Z Vendors: Apache Software Foundation Products: Apache SpamAssassin Problem Types: Remote Code Execution Description: A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3811-3/ - https://usn.ubuntu.com/3811-1/ - http://www.securityfocus.com/bid/105373 - https://security.gentoo.org/glsa/201812-07 - https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E - https://lists.debian.org/
ad.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E - https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html
CVE ID: CVE-2018-11781 State: PUBLISHED Published: 2018-09-17T14:00:00Z Last Updated: 2024-09-16T18:48:23.905Z Vendors: Apache Software Foundation Products: Apache SpamAssassin Problem Types: Local Code Execution Description: Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3811-3/ - https://usn.ubuntu.com/3811-1/ - https://security.gentoo.org/glsa/201812-07 - https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:2916 - https://lists.debian.org/debian-lts-ann
%40%3Cannounce.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:2916 - https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html
CVE ID: CVE-2018-11782 State: PUBLISHED Published: 2019-09-26T15:55:30 Last Updated: 2024-08-05T08:17:09.221Z Vendors: n/a Products: Apache Subversion Problem Types: Denial of Service Description: In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server. Additional Analyst Notes: - CVE Program Container: References: - http://subversion.apache.org/security/CVE-2018-11782-advisory.txt
CVE ID: CVE-2018-11783 State: PUBLISHED Published: 2019-03-07T18:00:00Z Last Updated: 2024-09-16T22:15:51.127Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: Information Disclosure Description: sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107032 - https://lists.apache.org/thread.html/4f102f943935476732fb
ainer: References: - http://www.securityfocus.com/bid/107032 - https://lists.apache.org/thread.html/4f102f943935476732fb1fb653d687c7b69d29d9792f0d6cf72c505e%40%3Cannounce.trafficserver.apache.org%3E
CVE ID: CVE-2018-11784 State: PUBLISHED Published: 2018-10-04T13:00:00Z Last Updated: 2024-09-16T17:04:04.205Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Open Redirect Description: When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://lists.apache.org/th
References: - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E - https://security.netapp.com/advisory/ntap-20181014-0002/ - http://www.securityfocus.com/bid/105524 - https://access.redhat.com/errata/RHSA-2019:0131 - https://access.redhat.com/errata/RHSA-2019:0485 - https://access.redhat.com/errata/RHSA-2019:0130 - https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html - https://usn.ubuntu.com/3787-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9
ps://lists.debian.org/debian-lts-announce/2018/10/msg00006.html - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - http
sts.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/ - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268ac
5f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html - https://access.redhat.com/errata/RHSA-2019:1529 - https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - https