huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Multiple stored XSS in task and process filters
CVE: CVE-2017-2674
Component: business-central
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2017-02-10T00:00:00+00:00

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
CVE: CVE-2017-1000474
Component: CVE-2017-1000474
Release date: 2017-12-29T00:00:00+00:00

Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php, login/profile.php, login/Actions.php, login/manage_employee.php, and login/sell.php scripts resulting in the expose of user's login credentials, SQL Injection and Stored XSS vulnerability, which leads to remote code executing.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
User can trigger arbitrary file read by X server causing a DoS
CVE: CVE-2017-16611
Component: libXfont
CWE: CWE-59
Severity: Low
CVSS v3: 2.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2017-11-25T00:00:00+00:00

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.


Remediation:
Information disclosure in the web publishing plugins
CVE: CVE-2017-1000024
Component: shotwell
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2017-07-07T00:00:00+00:00

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission


Remediation:
CVE: CVE-2017-1002019
Component: CVE-2017-1002019
Release date: 2017-01-01T00:00:00+00:00

Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer over-read in print-bgp.c:decode_multicast_vpn() in BGP parser
CVE: CVE-2017-13043
Component: tcpdump
CWE: CWE-125
Severity: Low
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2017-09-13T00:00:00+00:00

The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_multicast_vpn().


Remediation:
Access to unallocated memory possible in extract.c
CVE: CVE-2017-5332
Component: icoutils
CWE: CWE-125
Severity: Moderate
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-01-08T00:00:00+00:00

A vulnerability was found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in failure to allocate memory or an over-large memcpy operation, leading to a crash.


Remediation:
does not check length of chunks against user limit
CVE: CVE-2017-12652
Component: libpng
CWE: CWE-20
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2017-01-01T00:00:00+00:00

libpng before 1.6.32 does not properly check the length of chunks against the user limit.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications using libpng or must be restarted for the update to take effect.
Unchecked capabilities in net/netfilter/xt_osf.c allows for unprivileged modification to systemwide fingerprint list
CVE: CVE-2017-17450
Component: kernel
CWE: CWE-284
Severity: Low
CVSS v3: 4.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2017-12-05T00:00:00+00:00

net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations. This allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all network namespaces.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2, as a code with the flaw is not present or is not built in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Multiple security issues
CVE: CVE-2017-5627
Component: mujs
Release date: 2017-01-01T00:00:00+00:00

An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsR_setproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the js_pushstring function in jsrun.c when parsing a specially crafted JS file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Send Later with Delay bypasses OpenPGP
CVE: CVE-2017-9604
Component: kmail
CWE: CWE-201
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2017-06-13T00:00:00+00:00

It was found that KMail's Send Later with Delay function bypassed OpenPGP signing and encryption, causing the message to be sent unsigned and in plain-text. A remote attacker, with access to the user's network traffic, could potentially use this flaw to obtain sensitive information from the plain-text email messages.


Remediation:
Infinite loop due to insufficient checks in the DNS packet parser
CVE: CVE-2017-14339
Component: yadifa
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-09-13T00:00:00+00:00

The DNS packet parser in YADIFA before 2.2.6 does not check for the presence of infinite pointer loops, and thus it is possible to force it to enter an infinite loop. This can cause high CPU usage and makes the server unresponsive.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sensitive world readable files in /var/lib/rhsm/
CVE: CVE-2016-4455
Component: subscription-manager
CWE: CWE-732
Severity: Moderate
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-05-25T00:00:00+00:00

It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack.


Remediation:
address bar spoofing
CVE: CVE-2016-1657
Component: chromium-browser
Severity: Moderate
Release date: 2016-04-13T00:00:00+00:00

The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL.


Remediation:
qemu ioport out-of-bounds array access (XSA-199)
CVE: CVE-2016-9637
Component: Xen
CWE: CWE-125
Severity: Important
CVSS v3: 7.1/CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2016-12-06T00:00:00+00:00

An out of bounds array access issue was found in the Xen virtual machine monitor, built with the QEMU ioport support. It could occur while doing ioport read/write operations, if guest was to supply a 32bit address parameter. A privileged guest user/process could use this flaw to potentially escalate their privileges on a host.


Remediation:
Information leak in rds_inc_info_copy
CVE: CVE-2016-5244
Component: kernel
CWE: CWE-200
Severity: Low
Release date: 2016-06-03T00:00:00+00:00

A vulnerability was found in the Linux kernel in function rds_inc_info_copy of file net/rds/recv.c. The last field "flags" of object "minfo" is not initialized. This can leak data previously at the flags location to userspace.

Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6 and will not be addressed in a future update.

This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux  7, Realtime and Red Hat Enterprise MRG 2.

This has been rated as having low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/ .

Remediation:
Crash while parsing invalid chunked HTTP or UPnP response
CVE: CVE-2016-5301
Component: libtorrent
Release date: 2016-06-04T00:00:00+00:00

The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HTTP response or possibly a (2) UPnP broadcast.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTTPS NIO connector uses no timeout when reading SSL handshake from client
CVE: CVE-2016-2094
Component: EAP
CWE: CWE-358
Severity: Moderate
Release date: 2016-02-17T00:00:00+00:00

A read-timeout flaw was found in the HTTPS NIO Connector handling of SSL handshakes. A remote, unauthenticated attacker could create a socket and cause a thread to remain occupied indefinitely so long as the socket remained open (denial of service).


Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

The JBoss server process must be restarted for the update to take effect.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

The JBoss server process must be restarted for the update to take effect.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

The JBoss server process must be restarted for the update to take effect.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

The JBoss server process must be restarted for the update to take effect.
The References section of this erratum contains a download link (you must log in to download the update). The References section of this erratum contains a download link (you must log in to download the update). Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The JBoss server process must be restarted for the update to take effect.
Version 0.2.8.9 contains security fixes
CVE: CVE-2016-8860
Component: tor
Release date: 2016-10-17T00:00:00+00:00

Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data had NUL termination, but the implementation of or/buffers.c did not ensure that NUL termination was present, which allows remote attackers to cause a denial of service (client, hidden service, relay, or authority crash) via crafted data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple code execution issues fixed in APSB16-18
CVE: CVE-2016-4140
Component: flash-plugin
Severity: Critical
Release date: 2016-06-14T00:00:00+00:00

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.


Remediation:
heap overflow in blink
CVE: CVE-2016-5182
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-12T00:00:00+00:00

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Buffer overflow in Brotli decompression (MFSA 2016-30)
CVE: CVE-2016-1968
Component: Mozilla
Severity: Moderate
Release date: 2016-03-08T00:00:00+00:00

Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted data with brotli compression.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
usbip: buffer overflow by trusting length of incoming packets
CVE: CVE-2016-3955
Component: Kernel
CWE: CWE-120
Severity: Important
Release date: 2016-03-17T00:00:00+00:00

The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Remediation:
Null pointer dereference in convert.c
CVE: CVE-2016-7445
Component: openjpeg2
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-09-16T00:00:00+00:00

convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
display: virtio-gpu: information leakage in virgl_cmd_get_capset
CVE: CVE-2016-9908
Component: Qemu
CWE: CWE-200
Severity: Low
CVSS v3: 3.8/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Release date: 2016-11-01T00:00:00+00:00

Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.


Remediation:
Hard coded 1024 bit DH p parameter was not prime
CVE: CVE-2016-2217
Component: socat
CWE: CWE-327
Severity: Moderate
Release date: 2016-02-01T00:00:00+00:00

The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.


Remediation:
Null pointer dereference in print_frame_inst_bytes()
CVE: CVE-2016-5028
Component: libdwarf
CWE: CWE-476
Severity: Low
Release date: 2016-05-23T00:00:00+00:00

The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via an object file with empty bss-like sections.


Remediation:
heap overflow in the network plugin
CVE: CVE-2016-6254
Component: collectd
CWE: CWE-122
Severity: Moderate
CVSS v3: 8.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2016-07-26T00:00:00+00:00

A heap-based buffer overflow flaw was found in collectd's network plugin. The flaw allowed a remote attacker to crash the collectd daemon (denial of service) or possibly execute remote code using a crafted network packet. For this flaw to be exploited, the network plugin must be enabled.


Remediation:
proc: prevent accessing /proc/<pid>/environ until it's ready
CVE: CVE-2016-7916
Component: kernel
CWE: CWE-362
Severity: Low
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-01-19T00:00:00+00:00

Race condition in the environ_read() function in 'fs/proc/base.c' in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a '/proc/*/environ' file during a process-setup time interval in which environment-variable copying is incomplete.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Internal IP address disclosed on redirect when request header Host field is not set
CVE: CVE-2016-6311
Component: EAP7
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-07-03T00:00:00+00:00

It was found that when issuing a GET request which results in a 302 redirect, and when the request header 'Host' field was not set, the response header field 'Location' contains the internal IP address of the server. An attacker could use this disclose information which they are not authorized to access.


Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).
You can add a filter in the JBoss CLI that sets the host header to the 'myvirtualhost.com' if the host header is not present. eg:

/subsystem=undertow/configuration=filter/expression-filter=hostname:add(expression="header(header=Host, value=myvirtualhost.com)")
/subsystem=undertow/server=default-server/host=default-host/filter-ref=hostname:add(predicate="not exists(%{i,Host})")
Reflected XSS when submitting config file for VNC/SPICE Connection
CVE: CVE-2016-3113
Component: ovirt-engine
CWE: CWE-79
Severity: Moderate
Release date: 2016-04-13T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.


Remediation:
multiple code execution issues fixed in APSB16-32
CVE: CVE-2016-4286
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-11T00:00:00+00:00

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass intended access restrictions via unspecified vectors.


Remediation: