Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-1000004 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection (Cross-Site Scripting). This attack appears to be exploitable via the payload needs to be stored in the database and the victim must see the db value in question. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yugandhargangu/JspMyAdmin2/issues/22
CVE ID: CVE-2019-1000005 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.
ty appears to have been fixed in 7.1.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mpdf/mpdf/issues/949
CVE ID: CVE-2019-1000006 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/10739
CVE ID: CVE-2019-1000007 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.
or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/horazont/aioxmpp/pull/268
CVE ID: CVE-2019-1000008 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2. Additional Analyst N
mand on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2. Additional Analyst Notes: - CVE Program Container: References: - https://helm.sh/blog/helm-security-notice-2019/index.html
CVE ID: CVE-2019-1000009 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack appears to be exploitable via A POST request to the HTTP API can save a chart archive outside of the intended directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appe
directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appears to have been fixed in 0.8.1. Additional Analyst Notes: - CVE Program Container: References: - https://helm.sh/blog/chartmuseum-security-notice-2019/index.html
CVE ID: CVE-2019-1000010 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/2327 - https://github.com/phpipam/phpipam/commit/fd37bd8fb2b9c306079db505e0e3fe79a096c31c
CVE ID: CVE-2019-1000011 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/api-platform/core/issues/2364 - https://github.com/api-platform/core/pull/2441
CVE ID: CVE-2019-1000012 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hexpm/hex/pull/651 - https://github.com/hexpm/hex/pull/646
CVE ID: CVE-2019-1000013 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hexpm/hex_core/pull/51 - https://github.com/hexpm/hex_core/pull/48
CVE ID: CVE-2019-1000014 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erlang/rebar3/pull/1986
CVE ID: CVE-2019-1000015 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the co
exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03
CVE ID: CVE-2019-1000016 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ff
nces: - https://github.com/FFmpeg/FFmpeg/commit/b97a4b658814b2de8b9f2a3bce491c002d34de31#diff-cd7e24986650014d67f484f3ffceef3f
CVE ID: CVE-2019-1000017 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chamilo/chamilo-lms/commi
460983c03. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03 - https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-34-2019-01-14-Moderate-risk-moderate-impact-XSS-and-unauthorized-access
CVE ID: CVE-2019-1000018 State: PUBLISHED Published: 2019-02-04T21:00:00.000Z Last Updated: 2025-03-19T19:45:40.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission. Additional Analyst Notes: - CVE Program Container: References: - https://esnet-security.github.io/vulnerabilities/20190115_rssh - https://www.debian.org/security/2019/dsa-4377 - https://lists.debian.org/debian-lts-announce/2019
lities/20190115_rssh - https://www.debian.org/security/2019/dsa-4377 - https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html - https://usn.ubuntu.com/3946-1/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/ - https://security.gentoo.org/glsa/202007-29 - http://seclists.org/fulldisclosure/2021/May/78 - https://github.com/WlX-33/PoC-for-CVE/bl
ty.gentoo.org/glsa/202007-29 - http://seclists.org/fulldisclosure/2021/May/78 - https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-33216%2CCVE-2019-1000018/CommScope%20Ruckus%20IoT%20Controller%201.7.1.0%20Undocumented%20Account.txt
CVE ID: CVE-2019-1000019 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/pull/1120 - https://usn.ubuntu.com/3884-1/ - https://lis
ntainer: References: - https://github.com/libarchive/libarchive/pull/1120 - https://usn.ubuntu.com/3884-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html - https://github.com/libarchive/libarchive/pull/1120/commits/65a23f5dbee4497064e9bb467f81138a62b0dae1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html - https://access.redhat.com/errata/RHSA-2019:2298 - https://access.redhat.com/e
-security-announce/2019-04/msg00055.html - https://access.redhat.com/errata/RHSA-2019:2298 - https://access.redhat.com/errata/RHSA-2019:3698 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html
CVE ID: CVE-2019-1000020 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/pull/1120 -
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/pull/1120 - https://usn.ubuntu.com/3884-1/ - https://lists.debian.org/debian-lts-announce/2019/02/msg00013.html - https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html - https://access.redhat.com/errata/
ZZHRTG/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html - https://access.redhat.com/errata/RHSA-2019:2298 - https://access.redhat.com/errata/RHSA-2019:3698 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00015.html
CVE ID: CVE-2019-1000021 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability
the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://lab.louiz.org/poezio/slixmpp/commit/7cd73b594e8122dddf847953fcfc85ab4d316416 - https://xmpp.org/extensions/xep-0223.html#howitworks - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GKBXN7EAAR7ENEZUBKV6C6MP6QBXYTWT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIBP4LD2V4TBJSLZXDUAGQMD6CUI2
//lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIBP4LD2V4TBJSLZXDUAGQMD6CUI2TZR/
CVE ID: CVE-2019-1000022 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CSRF attack, possible leak of anti-CSRF token. This attack appears to be exploitable via malicious request against WebSocket handshake endpoint. This vulnerability appears to have been fixed in 1.14.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ptaoussanis/sente/issues/137
CVE ID: CVE-2019-1000023 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, id_access_type and id_attr_access that can result in a malicious attacker can include own SQL commands which database will execute. This attack appears to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Manage
rogram Container: References: - https://inf0seq.github.io/cve/2019/01/20/SQL-Injection-in-OPTOSS-Next-Gen-Network-Management-System-%28NG-NetMS%29.html - https://www.owasp.org/index.php/SQL_Injection - https://sourceforge.net/projects/ngnms/
CVE ID: CVE-2019-1000024 State: PUBLISHED Published: 2019-02-04T21:00:00 Last Updated: 2024-08-05T03:00:19.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result in Cross-site scripting.This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 - https://inf0
es: - CVE Program Container: References: - https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 - https://inf0seq.github.io/cve/2019/01/20/Cross-site-scripting-%28XSS%29-in-OPTOSS-Next-Gen-Network-Management-System-%28NG-NetMS%29.html - https://sourceforge.net/projects/ngnms/
CVE ID: CVE-2019-1000030 State: REJECTED Published: 2019-02-21T03:00:00Z Last Updated: 2024-09-17T02:51:41.670Z Description: No description available.
CVE ID: CVE-2019-1000031 State: PUBLISHED Published: 2019-03-27T17:55:00 Last Updated: 2024-08-05T03:00:19.265Z Vendors: article2pdf Products: article2pdf Wordpress plug-in Problem Types: disk consumption Description: A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Mar/49 - http://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.
gtraq/2019/Mar/49 - http://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html - https://wpvulndb.com/vulnerabilities/9246
CVE ID: CVE-2019-1000033 State: REJECTED Published: 2019-07-26T20:07:25 Last Updated: 2019-07-26T20:07:25 Description: No description available.
CVE ID: CVE-2019-1000041 State: REJECTED Published: 2019-02-21T03:00:00Z Last Updated: 2024-09-17T00:01:45.619Z Description: No description available.
CVE ID: CVE-2019-1000047 State: REJECTED Published: 2019-02-21T03:00:00Z Last Updated: 2024-09-16T16:28:09.910Z Description: No description available.
CVE ID: CVE-2019-1000048 State: REJECTED Published: 2019-02-21T03:00:00Z Last Updated: 2024-09-16T22:20:41.999Z Description: No description available.
CVE ID: CVE-2019-1000049 State: REJECTED Published: 2019-02-21T03:00:00Z Last Updated: 2024-09-16T16:18:49.242Z Description: No description available.
CVE ID: CVE-2019-1002100 State: PUBLISHED Published: 2019-04-01T14:14:27 Last Updated: 2024-08-05T03:00:19.258Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Kubernetes Products: Kubernetes Problem Types: Uncontrolled Resource Consumption Description: In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server. Additional Analyst Notes: -
nsumes excessive resources while processing, causing a Denial of Service on the API Server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/107290 - https://groups.google.com/forum/#%21topic/kubernetes-announce/vmUUNkYfG9g - https://github.com/kubernetes/kubernetes/issues/74534 - https://security.netapp.com/advisory/ntap-20190416-0002/ - https://access.redhat.com/errata/RHSA-2019:1851 - https://access.redhat.com/errata/RHSA-2019:3239
CVE ID: CVE-2019-1002101 State: PUBLISHED Published: 2019-04-01T14:14:27.768040Z Last Updated: 2024-09-16T20:46:49.730Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: Kubernetes Problem Types: Data Handling Description: The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machi