deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0780
Published: 2017-05-25
Description: It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtime 1.6.x versions prior to 1.6.18 do not properly enforce disk quotas in certain cases. An attacker could use an improper disk quota value to bypass enforcement and consume all the disk on DEAs/CELLs causing a potential denial of service for other applications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: https://pivotal.io/security/cve-2016-0780; https://pivotal.io/security/cve-2016-0780
CVE: CVE-2016-0781
Published: 2017-05-25
Description: The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pivotal.io/security/cve-2016-0781; https://pivotal.io/security/cve-2016-0781
CVE: CVE-2016-2165
Published: 2017-05-25
Description: The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20 are not cleansing request URL paths when they are invalid and are returning them in the 404 response. This could allow malicious scripts to be written directly into the 404 response.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://pivotal.io/security/cve-2016-2165; https://pivotal.io/security/cve-2016-2165
CVE: CVE-2016-3084
Published: 2017-05-25
Description: The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: https://pivotal.io/security/cve-2016-3084; https://pivotal.io/security/cve-2016-3084
CVE: CVE-2016-4435
Published: 2017-05-25
Description: An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-264
References: https://pivotal.io/security/cve-2016-4435; https://pivotal.io/security/cve-2016-4435
CVE: CVE-2016-4977
Published: 2017-05-25
Description: When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-19
References: http://www.openwall.com/lists/oss-security/2019/10/16/1; https://lists.apache.org/thread.html/0841d849c23418c473ccb9183cbf41a317cb0476e44be48022ce3488%40%3Cdev.fineract.apache.org%3E; https://lists.apache.org/thread.html/37d7e820fc65a768de3e096e98382d5529a52a039f093e59357d0bc0%40%3Cdev.fineract.apache.org%3E
CVE: CVE-2016-5007
Published: 2017-05-25
Description: Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/91687; https://pivotal.io/security/cve-2016-5007
CVE: CVE-2016-6256
Published: 2017-05-26
Description: SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-611
References: http://packetstormsecurity.com/files/142597/SAP-Business-One-For-Android-1.2.3-XML-Injection.html; http://www.securityfocus.com/bid/98590; https://www.exploit-db.com/exploits/42036/
CVE: CVE-2017-5868
Published: 2017-05-26
Description: CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATH_INFO to __session_start__/.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: http://www.openwall.com/lists/oss-security/2017/05/23/13; http://www.securitytracker.com/id/1038547; https://sysdream.com/news/lab/2017-05-05-cve-2017-5868-openvpn-access-server-crlf-injection-with-session-fixation/
CVE: CVE-2017-7236
Published: 2017-05-26
Description: SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]
CVE: CVE-2017-7439
Published: 2017-05-26
Description: NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]; https://kb.netapp.com/support/s/article/NTAP-20[PII_REDACTED]
CVE: CVE-2017-9032
Published: 2017-05-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) T1 or (2) tmLastConfigFileModifiedDate parameter to log_management.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html; http://seclists.org/fulldisclosure/2017/May/91; http://www.securitytracker.com/id/1038548
CVE: CVE-2017-9033
Published: 2017-05-26
Description: Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html; http://seclists.org/fulldisclosure/2017/May/91; http://www.securitytracker.com/id/1038548
CVE: CVE-2017-9034
Published: 2017-05-26
Description: Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges by leveraging failure to validate software updates.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html; http://seclists.org/fulldisclosure/2017/May/91; http://www.securitytracker.com/id/1038548
CVE: CVE-2017-9035
Published: 2017-05-26
Description: Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with update servers.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html; http://seclists.org/fulldisclosure/2017/May/91; http://www.securitytracker.com/id/1038548
CVE: CVE-2017-9036
Published: 2017-05-26
Description: Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html; http://seclists.org/fulldisclosure/2017/May/91; http://www.securitytracker.com/id/1038548
CVE: CVE-2017-9037
Published: 2017-05-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) S44, (2) S5, (3) S_action_fail, (4) S_ptn_update, (5) T113, (6) T114, (7) T115, (8) T117117, (9) T118, (10) T_action_fail, (11) T_ptn_update, (12) textarea, (13) textfield5, or (14) tmLastConfigFileModifiedDate parameter to notification.cgi.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html; http://seclists.org/fulldisclosure/2017/May/91; http://www.securitytracker.com/id/1038548
CVE: CVE-2017-9239
Published: 2017-05-26
Description: An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://dev.exiv2.org/issues/1295; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html; http://www.securityfocus.com/bid/98720
CVE: CVE-2017-1291
Published: 2017-05-26
Description: IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 125152.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22003413; https://exchange.xforce.ibmcloud.com/vulnerabilities/125152; http://www.ibm.com/support/docview.wss?uid=swg22003413
CVE: CVE-2017-1292
Published: 2017-05-26
Description: IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the system. IBM X-Force ID: 125153.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22003414; https://exchange.xforce.ibmcloud.com/vulnerabilities/125153; http://www.ibm.com/support/docview.wss?uid=swg22003414
CVE: CVE-2017-1325
Published: 2017-05-26
Description: IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125976.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22003497; http://www.securitytracker.com/id/1038600; https://exchange.xforce.ibmcloud.com/vulnerabilities/125976
CVE: CVE-2017-7505
Published: 2017-05-26
Description: Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-269
References: http://projects.theforeman.org/issues/19612; http://www.securityfocus.com/bid/98607; https://github.com/theforeman/foreman/pull/4545
CVE: CVE-2015-0269
Published: 2017-05-26
Description: Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://contao.org/en/news/contao-3_2_19.html; https://contao.org/en/news/contao-3_4_4.html; https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html
CVE: CVE-2016-10375
Published: 2017-05-26
Description: Yodl before 3.07.01 has a Buffer Over-read in the queue_push function in queue/queuepush.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/fbb-git/yodl/commit/fd85f8c94182558ff1480d06a236d6fb927979a3; https://github.com/fbb-git/yodl/issues/1; https://lists.debian.org/debian-lts-announce/2020/04/msg00026.html
CVE: CVE-2017-6862
Published: 2017-05-26
Description: NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: http://www.securityfocus.com/bid/98740; https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261; https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_netgear_wnr2000v5_-_cve-2017-6862.pdf
CVE: CVE-2017-8535
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8536, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-369, CWE-476, CWE-674
References: http://www.securityfocus.com/bid/98702; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8535
CVE: CVE-2017-8536
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-369, CWE-476, CWE-674
References: http://www.securityfocus.com/bid/98708; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8536
CVE: CVE-2017-8537
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8536, CVE-2017-8539, and CVE-2017-8542.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-369, CWE-476, CWE-674
References: http://www.securityfocus.com/bid/98705; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8537
CVE: CVE-2017-8538
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8540 and CVE-2017-8541.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98706; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8538
CVE: CVE-2017-8539
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8536, CVE-2017-8537, and CVE-2017-8542.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-369, CWE-476, CWE-674
References: http://www.securityfocus.com/bid/98704; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8539
CVE: CVE-2017-8540
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/98703; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8540
CVE: CVE-2017-8541
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8540.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98710; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8541
CVE: CVE-2017-8542
Published: 2017-05-26
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8536, CVE-2017-8537, and CVE-2017-8539.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-369, CWE-476, CWE-674
References: http://www.securityfocus.com/bid/98707; http://www.securitytracker.com/id/1038571; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8542
CVE: CVE-2017-9021
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-5937.  Reason: This candidate is a reservation duplicate of CVE-2017-5937.  Notes: All CVE users should reference CVE-2017-5937 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-0041
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2009-0797
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2009-2418
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2009-4036
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2009-4268
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2009-4275
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2009.  Notes: none
CVE: CVE-2009-4276
Published: 2017-05-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was in a CNA pool that was not assigned to any issues during 2009.  Notes: none
CVE: CVE-2017-5646
Published: 2017-05-26
Description: For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be easily associated with the authenticated user, this is still a serious security issue. All users are recommended to upgrade to the Apache Knox 0.12.0 release.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-346
References: http://mail-archives.apache.org/mod_mbox/knox-user/201705.mbox/%3CCACRbFyjtT7QQGHUzTRdbJoySbJb7tt4BDk5-r-VRn0GB0Kgvag%40mail.gmail.com%3E; http://www.securityfocus.com/bid/98739; https://lists.apache.org/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48%40%3Cdev.logging.apache.org%3E
CVE: CVE-2016-8496
Published: 2017-05-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none