mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
- Synchronized data.
This commit is contained in:
CVE Team
parent
de20661dfe
commit
9ab94d6602
@ -2,7 +2,7 @@
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ID" : "CVE-2016-8489",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "REJECT"
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
@ -11,7 +11,7 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10242. Reason: This candidate is a reservation duplicate of CVE-2016-10242. Notes: All CVE users should reference CVE-2016-10242 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,33 +1,10 @@
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve-assign@distributedweaknessfiling.org",
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"DATE_ASSIGNED" : "2017-12-29",
|
||||
"ID" : "CVE-2017-1000500",
|
||||
"REQUESTER" : "jordan.potti@state.mn.us",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Keycloak",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "All versions prior to 2.x"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Keycloak"
|
||||
}
|
||||
]
|
||||
}
|
||||
"STATE" : "REJECT"
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
@ -36,28 +13,7 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Keycloak SSO versions prior to 2.x are vulnerable to Host Header Injection on the forgot password page causing the application to send a poisoned URL as the password reset link."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Host Header Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://github.com/keycloak/keycloak-documentation/pull/268/commits/a2b58aadee42af2c375b72e86dffc2cf23cc3770",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://github.com/keycloak/keycloak-documentation/pull/268/commits/a2b58aadee42af2c375b72e86dffc2cf23cc3770"
|
||||
"value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-12161. Reason: This candidate is a reservation duplicate of CVE-2017-12161. Notes: All CVE users should reference CVE-2017-12161 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1 +1,64 @@
|
||||
{"data_version": "4.0","references": {"reference_data": [{"url": "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595"}]},"description": {"description_data": [{"lang": "eng","value": "A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.153 and earlier, LTS 2.138.3 and earlier"}]},"product_name": "Jenkins"}]},"vendor_name": "Jenkins project"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2018-12-09T22:34:33.128433","ID": "CVE-2018-1000861","ASSIGNER": "kurt@seifried.org","REQUESTER": "ml@beckweb.net"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "CWE-693"}]}]}}
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "kurt@seifried.org",
|
||||
"DATE_ASSIGNED" : "2018-12-09T22:34:33.128433",
|
||||
"ID" : "CVE-2018-1000861",
|
||||
"REQUESTER" : "ml@beckweb.net",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Jenkins",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.153 and earlier, LTS 2.138.3 and earlier"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Jenkins project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "CWE-693"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1 +1,64 @@
|
||||
{"data_version": "4.0","references": {"reference_data": [{"url": "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904"}]},"description": {"description_data": [{"lang": "eng","value": "An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.153 and earlier, LTS 2.138.3 and earlier"}]},"product_name": "Jenkins"}]},"vendor_name": "Jenkins project"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2018-12-09T22:34:33.129566","ID": "CVE-2018-1000862","ASSIGNER": "kurt@seifried.org","REQUESTER": "ml@beckweb.net"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "CWE-61"}]}]}}
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "kurt@seifried.org",
|
||||
"DATE_ASSIGNED" : "2018-12-09T22:34:33.129566",
|
||||
"ID" : "CVE-2018-1000862",
|
||||
"REQUESTER" : "ml@beckweb.net",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Jenkins",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.153 and earlier, LTS 2.138.3 and earlier"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Jenkins project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "CWE-61"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1 +1,64 @@
|
||||
{"data_version": "4.0","references": {"reference_data": [{"url": "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072"}]},"description": {"description_data": [{"lang": "eng","value": "A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.153 and earlier, LTS 2.138.3 and earlier"}]},"product_name": "Jenkins"}]},"vendor_name": "Jenkins project"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2018-12-09T22:34:33.130546","ID": "CVE-2018-1000863","ASSIGNER": "kurt@seifried.org","REQUESTER": "ml@beckweb.net"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "CWE-20"}]}]}}
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "kurt@seifried.org",
|
||||
"DATE_ASSIGNED" : "2018-12-09T22:34:33.130546",
|
||||
"ID" : "CVE-2018-1000863",
|
||||
"REQUESTER" : "ml@beckweb.net",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Jenkins",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.153 and earlier, LTS 2.138.3 and earlier"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Jenkins project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1072"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1 +1,64 @@
|
||||
{"data_version": "4.0","references": {"reference_data": [{"url": "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1193"}]},"description": {"description_data": [{"lang": "eng","value": "A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.153 and earlier, LTS 2.138.3 and earlier"}]},"product_name": "Jenkins"}]},"vendor_name": "Jenkins project"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2018-12-09T22:34:33.131172","ID": "CVE-2018-1000864","ASSIGNER": "kurt@seifried.org","REQUESTER": "ml@beckweb.net"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "CWE-606"}]}]}}
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "kurt@seifried.org",
|
||||
"DATE_ASSIGNED" : "2018-12-09T22:34:33.131172",
|
||||
"ID" : "CVE-2018-1000864",
|
||||
"REQUESTER" : "ml@beckweb.net",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Jenkins",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.153 and earlier, LTS 2.138.3 and earlier"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Jenkins project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "CWE-606"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1193",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-1193"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1 +1,64 @@
|
||||
{"data_version": "4.0","references": {"reference_data": [{"url": "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186"}]},"description": {"description_data": [{"lang": "eng","value": "A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed."}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "1.47 and earlier"}]},"product_name": "Script Security Plugin"}]},"vendor_name": "Jenkins project"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2018-12-09T22:41:05.610667","ID": "CVE-2018-1000865","ASSIGNER": "kurt@seifried.org","REQUESTER": "ml@beckweb.net"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "CWE-184, CWE-693"}]}]}}
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "kurt@seifried.org",
|
||||
"DATE_ASSIGNED" : "2018-12-09T22:41:05.610667",
|
||||
"ID" : "CVE-2018-1000865",
|
||||
"REQUESTER" : "ml@beckweb.net",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Script Security Plugin",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "1.47 and earlier"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Jenkins project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "CWE-184, CWE-693"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1 +1,64 @@
|
||||
{"data_version": "4.0","references": {"reference_data": [{"url": "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186"}]},"description": {"description_data": [{"lang": "eng","value": "A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM"}]},"data_type": "CVE","affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "2.59 and earlier"}]},"product_name": "Pipeline: Groovy Plugin"}]},"vendor_name": "Jenkins project"}]}},"CVE_data_meta": {"DATE_ASSIGNED": "2018-12-09T22:41:05.612186","ID": "CVE-2018-1000866","ASSIGNER": "kurt@seifried.org","REQUESTER": "ml@beckweb.net"},"data_format": "MITRE","problemtype": {"problemtype_data": [{"description": [{"lang": "eng","value": "CWE-184, CWE-693"}]}]}}
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "kurt@seifried.org",
|
||||
"DATE_ASSIGNED" : "2018-12-09T22:41:05.612186",
|
||||
"ID" : "CVE-2018-1000866",
|
||||
"REQUESTER" : "ml@beckweb.net",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Pipeline: Groovy Plugin",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.59 and earlier"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "Jenkins project"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "CWE-184, CWE-693"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,74 +1,14 @@
|
||||
{
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951."
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version" : "4.0",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"E" : "U",
|
||||
"RC" : "C"
|
||||
},
|
||||
"BM" : {
|
||||
"AV" : "N",
|
||||
"A" : "N",
|
||||
"SCORE" : "5.400",
|
||||
"AC" : "L",
|
||||
"UI" : "R",
|
||||
"PR" : "L",
|
||||
"C" : "L",
|
||||
"S" : "C",
|
||||
"I" : "L"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"ID" : "CVE-2018-1671",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2018-12-05T00:00:00",
|
||||
"STATE" : "PUBLIC",
|
||||
"ASSIGNER" : "psirt@us.ibm.com"
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "https://www.ibm.com/support/docview.wss?uid=ibm10739019",
|
||||
"title" : "IBM Security Bulletin 739019 (Cram Social Program Management)",
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/docview.wss?uid=ibm10739019"
|
||||
},
|
||||
{
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/144951",
|
||||
"name" : "ibm-curam-cve20181671-html-injection (144951)",
|
||||
"refsource" : "XF",
|
||||
"title" : "X-Force Vulnerability Report"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"data_format" : "MITRE",
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"value" : "Gain Access",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
"ID" : "CVE-2018-1671",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"vendor_name" : "IBM",
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
@ -82,9 +22,67 @@
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"BM" : {
|
||||
"A" : "N",
|
||||
"AC" : "L",
|
||||
"AV" : "N",
|
||||
"C" : "L",
|
||||
"I" : "L",
|
||||
"PR" : "L",
|
||||
"S" : "C",
|
||||
"SCORE" : "5.400",
|
||||
"UI" : "R"
|
||||
},
|
||||
"TM" : {
|
||||
"E" : "U",
|
||||
"RC" : "C",
|
||||
"RL" : "O"
|
||||
}
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Gain Access"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/docview.wss?uid=ibm10739019",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.ibm.com/support/docview.wss?uid=ibm10739019"
|
||||
},
|
||||
{
|
||||
"name" : "ibm-curam-cve20181671-html-injection(144951)",
|
||||
"refsource" : "XF",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/144951"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,55 +1,9 @@
|
||||
{
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"BM" : {
|
||||
"PR" : "N",
|
||||
"C" : "L",
|
||||
"S" : "U",
|
||||
"I" : "N",
|
||||
"AV" : "L",
|
||||
"SCORE" : "4.000",
|
||||
"AC" : "L",
|
||||
"A" : "N",
|
||||
"UI" : "N"
|
||||
},
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"RC" : "C",
|
||||
"E" : "U"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"STATE" : "PUBLIC",
|
||||
"DATE_PUBLIC" : "2018-12-06T00:00:00",
|
||||
"ID" : "CVE-2018-1957",
|
||||
"DATE_PUBLIC" : "2018-12-06T00:00:00"
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "https://www.ibm.com/support/docview.wss?uid=ibm10744247",
|
||||
"title" : "IBM Security Bulletin 744247 (WebSphere Application Server)",
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/docview.wss?uid=ibm10744247"
|
||||
},
|
||||
{
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153629",
|
||||
"name" : "ibm-websphere-cve20181957-info-disc (153629)",
|
||||
"refsource" : "XF",
|
||||
"title" : "X-Force Vulnerability Report"
|
||||
}
|
||||
]
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
@ -58,14 +12,14 @@
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "WebSphere Application Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "9"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name" : "WebSphere Application Server"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -74,6 +28,37 @@
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"BM" : {
|
||||
"A" : "N",
|
||||
"AC" : "L",
|
||||
"AV" : "L",
|
||||
"C" : "L",
|
||||
"I" : "N",
|
||||
"PR" : "N",
|
||||
"S" : "U",
|
||||
"SCORE" : "4.000",
|
||||
"UI" : "N"
|
||||
},
|
||||
"TM" : {
|
||||
"E" : "U",
|
||||
"RC" : "C",
|
||||
"RL" : "O"
|
||||
}
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
@ -86,5 +71,18 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_format" : "MITRE"
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/docview.wss?uid=ibm10744247",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.ibm.com/support/docview.wss?uid=ibm10744247"
|
||||
},
|
||||
{
|
||||
"name" : "ibm-websphere-cve20181957-info-disc(153629)",
|
||||
"refsource" : "XF",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153629"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user