Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-2628 State: PUBLISHED Published: 2018-03-12T15:00:00Z Last Updated: 2024-08-05T14:02:06.934Z Vendors: Red Hat, Inc. Products: curl Problem Types: CWE-287 Description: curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0847.html - http://www.securityfocus.com/bid/97187 - https://bugzilla.redhat.com/show_bug.cgi?id=1422464
CVE ID: CVE-2017-2629 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:06.938Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CURL Products: curl Problem Types: CWE-295 Description: curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that t
question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96382 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629 - http://www.securitytracker.com/id/1037871 - https://www.tenable.com/security/tns-2017-09 - https://curl.haxx.se/docs/adv_20170222.html - https://security.gentoo.org/glsa/201703-04
CVE ID: CVE-2017-2630 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.177Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: QEMU Products: Qemu: Problem Types: CWE-121 Description: A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process. Additional Analyst Notes: - CVE Program Container:
te arbitrary code on client host with privileges of the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2392 - http://www.securityfocus.com/bid/96265 - https://security.gentoo.org/glsa/201704-01 - http://www.openwall.com/lists/oss-security/2017/02/15/2 - https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630 - https://bugzilla.redhat.com/show_bug.cgi?id=1422415 - https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
CVE ID: CVE-2017-2631 State: REJECTED Published: 2022-08-08T18:52:31 Last Updated: 2022-08-08T18:52:31 Description: No description available.
CVE ID: CVE-2017-2632 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:06.842Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: cfme Problem Types: CWE-285 Description: A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2632 - http://www.securityfocus.com/bid/96478
ainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2632 - http://www.securityfocus.com/bid/96478 - http://rhn.redhat.com/errata/RHSA-2017-0320.html
CVE ID: CVE-2017-2633 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:06.898Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: QEMU Products: Qemu: Problem Types: CWE-120 Description: An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/02/23/1 - https://git.qemu.org/?p=qemu.git%3Ba=commit
ner: References: - http://www.openwall.com/lists/oss-security/2017/02/23/1 - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=bea60dd7679364493a0d7f5b54316c767cf894ef - https://access.redhat.com/errata/RHSA-2017:1206 - https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9f64916da20eea67121d544698676295bbb105a7 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2633 - https://access.redhat.com/errata/RHSA-2017:1441 - http://www.securityfocus.com/bid/96417 - https://access.redhat.com/errata/RHSA-2017:1856 - https://access.redhat.com/errata/RHSA-2017:1205
CVE ID: CVE-2017-2634 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:06.941Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Linux Products: kernel: Problem Types: CWE-476 Description: It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections, which could result in memory corruptions. A remote attacker could use this flaw to crash the system. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0323.html - https://git.kernel.org/pub/
s: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0323.html - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f53dc67c5e7babafe239b93a11678b0e05bead51 - http://rhn.redhat.com/errata/RHSA-2017-0347.html - http://www.securitytracker.com/id/1037909 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2634 - http://rhn.redhat.com/errata/RHSA-2017-0346.html - http://www.securityfocus.com/bid/96529
CVE ID: CVE-2017-2635 State: PUBLISHED Published: 2018-08-22T21:00:00 Last Updated: 2024-08-05T14:02:06.995Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: The libvirt Project Products: libvirt Problem Types: CWE-476 Description: A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2635 - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=c3de387380f6057ee0e46cd9f2f0a092e8070875
CVE ID: CVE-2017-2636 State: PUBLISHED Published: 2017-03-07T22:00:00 Last Updated: 2024-08-05T14:02:06.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0892 - http://www.securityfocus.com/bid/96732 - http://www.securitytracker.com/id/1037963 - https://access.redhat.com/errata/RHSA-2017:0932 - http://www.openwall.com/lists/oss-security/2017/03/07/6 - https://bugzilla.redhat.com/show
t.com/errata/RHSA-2017:0932 - http://www.openwall.com/lists/oss-security/2017/03/07/6 - https://bugzilla.redhat.com/show_bug.cgi?id=1428319 - https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html - https://access.redhat.com/errata/RHSA-2017:1125 - https://access.redhat.com/errata/RHSA-2017:0933 - https://access.redhat.com/errata/RHSA-2017:1232 - https://access.redhat.com/errata/RHSA-2017:0931 - http://www.debian.org/security/2017/dsa-3804 - https://access.redhat.com/errata/RHSA-2017:1233 - https://access.redhat.com/errata/RHSA-2017:1488 - https://access.redhat.com/errata/RHSA-2017:0986 - https://access.redhat.com/errata/RHSA-2017:1126
CVE ID: CVE-2017-2637 State: PUBLISHED Published: 2018-07-26T12:00:00 Last Updated: 2024-08-05T14:02:06.920Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: [UNKNOWN] Products: rhosp-director Problem Types: CWE-306 Description: A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed
ss, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1546 - https://access.redhat.com/errata/RHSA-2017:1537 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2637 - http://www.securityfocus.com/bid/98576 - https://wiki.openstack.org/wiki/OSSN/OSSN-0007 - https://access.redhat.com/solutions/3022771 - https://access.redhat.com/errata/RHSA-2017:1
ack.org/wiki/OSSN/OSSN-0007 - https://access.redhat.com/solutions/3022771 - https://access.redhat.com/errata/RHSA-2017:1242 - https://access.redhat.com/errata/RHSA-2017:1504
CVE ID: CVE-2017-2638 State: PUBLISHED Published: 2018-07-16T13:00:00 Last Updated: 2024-08-05T14:02:06.903Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: infinispan Problem Types: CWE-306 Description: It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638 - http://rhn.redhat.com/errata/RHSA-2017-1097.html - https://issues.jboss.org/browse/ISPN-7485 - https
?id=CVE-2017-2638 - http://rhn.redhat.com/errata/RHSA-2017-1097.html - https://issues.jboss.org/browse/ISPN-7485 - https://github.com/infinispan/infinispan/pull/4936/commits - http://www.securityfocus.com/bid/97964
CVE ID: CVE-2017-2639 State: PUBLISHED Published: 2018-07-27T13:00:00 Last Updated: 2024-08-05T14:02:06.927Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: CloudForms Problem Types: CWE-295 Description: It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98769 - https
udForms. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98769 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2639 - https://access.redhat.com/errata/RHSA-2017:1367 - http://www.securitytracker.com/id/1038599
CVE ID: CVE-2017-2640 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.253Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Pidgin Products: pidgin Problem Types: CWE-787 Description: An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use this flaw to crash Pidgin or execute arbitrary code in the context of the pidgin process. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-10 - https://access.redhat.com/errata/RHSA-2017:1854 - http://www.securityfocus.com/bid/96775 - https://bugzilla.re
1706-10 - https://access.redhat.com/errata/RHSA-2017:1854 - http://www.securityfocus.com/bid/96775 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2640 - https://www.debian.org/security/2017/dsa-3806
CVE ID: CVE-2017-2641 State: PUBLISHED Published: 2017-03-26T18:00:00 Last Updated: 2024-08-05T14:02:07.130Z Vendors: n/a Products: Moodle 2.x and 3.x Problem Types: SQL injection Description: In Moodle 2.x and 3.x, SQL injection can occur via user preferences. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/41828/ - http://www.securityfocus.com/bid/96977 - https://moodle.org/mod/forum/discuss.php?d=349419 - http://www.securitytracker.com/id/1038174
CVE ID: CVE-2017-2642 State: PUBLISHED Published: 2017-07-17T16:00:00 Last Updated: 2024-08-05T14:02:07.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle 3.x has user fullname disclosure on the user preferences page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99606 - https://moodle.org/mod/forum/discuss.php?d=355554
CVE ID: CVE-2017-2643 State: PUBLISHED Published: 2017-03-26T18:00:00 Last Updated: 2024-08-05T14:02:07.115Z Vendors: n/a Products: Moodle 3.2.x Problem Types: Global search displays user names for unauthenticated users Description: In Moodle 3.2.x, global search displays user names for unauthenticated users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96978 - http://www.securitytracker.com/id/1038174 - https://moodle.org/mod/forum/discuss.php?d=349420
CVE ID: CVE-2017-2644 State: PUBLISHED Published: 2017-03-26T18:00:00 Last Updated: 2024-08-05T14:02:06.992Z Vendors: n/a Products: Moodle 3.x Problem Types: XSS Description: In Moodle 3.x, XSS can occur via evidence of prior learning. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=349421 - http://www.securitytracker.com/id/1038174 - http://www.securityfocus.com/bid/96979
CVE ID: CVE-2017-2645 State: PUBLISHED Published: 2017-03-26T18:00:00 Last Updated: 2024-08-05T14:02:07.145Z Vendors: n/a Products: Moodle 3.x Problem Types: XSS Description: In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96982 - http://www.securitytracker.com/id/1038174 - https://moodle.org/mod/forum/discuss.php?d=349422
CVE ID: CVE-2017-2646 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.264Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: keycloak Problem Types: CWE-835 Description: It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2646 - http://www.securityfocus.com/bid/96882
CVE ID: CVE-2017-2647 State: PUBLISHED Published: 2017-03-31T04:26:00 Last Updated: 2024-08-05T14:02:07.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2437 - https://access.redhat.com/errata/RHSA-2017:2444 - http://www.securityfocus.com/bid/97258 - https://github.com/torvalds/linux/commit
ess.redhat.com/errata/RHSA-2017:2444 - http://www.securityfocus.com/bid/97258 - https://github.com/torvalds/linux/commit/c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81 - https://usn.ubuntu.com/3849-1/ - https://usn.ubuntu.com/3849-2/ - https://access.redhat.com/errata/RHSA-2017:2077 - https://access.redhat.com/errata/RHSA-2017:1842 - https://bugzilla.redhat.com/show_bug.cgi?id=1428353 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81
CVE ID: CVE-2017-2648 State: PUBLISHED Published: 2018-07-27T20:00:00 Last Updated: 2024-08-05T14:02:07.222Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Jenkins Products: jenkins-ssh-slaves-plugin Problem Types: CWE-295 Description: It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96985 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2648 - https://jenkins.io/security/advisory/2017-03-20/
CVE ID: CVE-2017-2649 State: PUBLISHED Published: 2018-07-27T20:00:00Z Last Updated: 2024-09-16T19:51:23.494Z Vendors: Jenkins project Products: Active Directory Jenkins plugin Problem Types: CWE-295 Description: It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96986 - https://jenkins.io/security/advisory/2017-03-20/
CVE ID: CVE-2017-2650 State: PUBLISHED Published: 2018-07-27T20:00:00Z Last Updated: 2024-09-17T04:28:53.806Z Vendors: Jenkins project Products: Pipeline: Classpath Step Jenkins plugin Problem Types: CWE-592 Description: It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96981 - https://jenkins.io/security/advisory/2017-03-20/
CVE ID: CVE-2017-2651 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.157Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Jenkins Products: jenkins-mailer-plugin Problem Types: CWE-200 Description: jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addres
e who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96984 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2651 - https://jenkins.io/security/advisory/2017-03-20/
CVE ID: CVE-2017-2652 State: PUBLISHED Published: 2018-07-27T20:00:00Z Last Updated: 2024-09-16T19:31:32.320Z Vendors: Jenkins project Products: DistFork Jenkins plugin Problem Types: CWE-862 Description: It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission to run arbitrary shell commands on all connected nodes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96980 - https://jenkins.io/security/advisory/2017-03-20/
CVE ID: CVE-2017-2653 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.308Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Red Hat Products: CloudForms Problem Types: CWE-20 Description: A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/e
ttacks in order to execute. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0898 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2653 - http://www.securityfocus.com/bid/96964
CVE ID: CVE-2017-2654 State: PUBLISHED Published: 2018-08-06T22:00:00 Last Updated: 2024-08-05T14:02:06.940Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: jenkins-email-ext Problem Types: CWE-200 Description: jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was bein
le who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2654 - https://jenkins.io/security/advisory/2017-03-20/
CVE ID: CVE-2017-2655 State: REJECTED Published: 2017-03-29T05:23:00 Last Updated: 2017-03-29T04:57:01 Description: No description available.
CVE ID: CVE-2017-2656 State: REJECTED Published: 2017-03-18T03:51:00 Last Updated: 2017-03-18T03:57:01 Description: No description available.
CVE ID: CVE-2017-2657 State: REJECTED Published: 2022-08-08T18:52:37 Last Updated: 2022-08-08T18:52:37 Description: No description available.
CVE ID: CVE-2017-2658 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.203Z Severity: LOW (CVSS 2.6 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: BPMS, JDV Problem Types: CWE-20 Description: It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking). Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.co
ons in the Console (clickjacking). Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0557.html - https://access.redhat.com/errata/RHSA-2018:2243 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2658 - http://www.securityfocus.com/bid/97025