admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-08 14:08:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Synchronized data.

Browse Source
This commit is contained in:
CVE Team 2018-11-16 16:06:26 -05:00
parent 509d838d65
commit b39afc999b
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
4 changed files with 55 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
2018/1000xxx/CVE-2018-1000007.json
View File

@ -36,7 +36,7 @@
"description_data" : [ "description_data" : [
{ {
"lang" : "eng", "lang" : "eng",
"value" : "libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequest hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request." "value" : "libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."
} }
] ]
}, },

103
2018/15xxx/CVE-2018-15769.json
View File

@ -1,87 +1,88 @@
{ {
"CVE_data_meta": { "CVE_data_meta" : {
"ASSIGNER": "secure@dell.com", "ASSIGNER" : "secure@dell.com",
"DATE_PUBLIC": "2018-11-12T18:00:00.000Z", "DATE_PUBLIC" : "2018-11-12T18:00:00.000Z",
"ID": "CVE-2018-15769", "ID" : "CVE-2018-15769",
"STATE": "PUBLIC", "STATE" : "PUBLIC",
"TITLE": "DSA-2018-198: RSA® BSAFE® Micro Edition Suite Key Management Error Vulnerability" "TITLE" : "DSA-2018-198: RSA® BSAFE® Micro Edition Suite Key Management Error Vulnerability"
}, },
"affects": { "affects" : {
"vendor": { "vendor" : {
"vendor_data": [ "vendor_data" : [
{ {
"product": { "product" : {
"product_data": [ "product_data" : [
{ {
"product_name": "BSAFE Micro Edition Suite", "product_name" : "BSAFE Micro Edition Suite",
"version": { "version" : {
"version_data": [ "version_data" : [
{ {
"affected": "<", "affected" : "<",
"version_value": "4.0.11" "version_value" : "4.0.11"
}, },
{ {
"affected": "<", "affected" : "<",
"version_value": "4.1.6.2" "version_value" : "4.1.6.2"
} }
] ]
} }
} }
] ]
}, },
"vendor_name": "RSA " "vendor_name" : "RSA "
} }
] ]
} }
}, },
"data_format": "MITRE", "data_format" : "MITRE",
"data_type": "CVE", "data_type" : "CVE",
"data_version": "4.0", "data_version" : "4.0",
"description": { "description" : {
"description_data": [ "description_data" : [
{ {
"lang": "eng", "lang" : "eng",
"value": "RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x \nseries) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) \non TLS clients during the handshake when a very large prime value is sent to the TLS client, and an Ephemeral or \nAnonymous Diffie-Hellman cipher suite (DHE or ADH) is used." "value" : "RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) on TLS clients during the handshake when a very large prime value is sent to the TLS client, and an Ephemeral or Anonymous Diffie-Hellman cipher suite (DHE or ADH) is used."
} }
] ]
}, },
"impact": { "impact" : {
"cvss": { "cvss" : {
"attackComplexity": "LOW", "attackComplexity" : "LOW",
"attackVector": "NETWORK", "attackVector" : "NETWORK",
"availabilityImpact": "LOW", "availabilityImpact" : "LOW",
"baseScore": 5.3, "baseScore" : 5.3,
"baseSeverity": "MEDIUM", "baseSeverity" : "MEDIUM",
"confidentialityImpact": "NONE", "confidentialityImpact" : "NONE",
"integrityImpact": "NONE", "integrityImpact" : "NONE",
"privilegesRequired": "NONE", "privilegesRequired" : "NONE",
"scope": "UNCHANGED", "scope" : "UNCHANGED",
"userInteraction": "NONE", "userInteraction" : "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0" "version" : "3.0"
} }
}, },
"problemtype": { "problemtype" : {
"problemtype_data": [ "problemtype_data" : [
{ {
"description": [ "description" : [
{ {
"lang": "eng", "lang" : "eng",
"value": "key management error issue" "value" : "key management error issue"
} }
] ]
} }
] ]
}, },
"references": { "references" : {
"reference_data": [ "reference_data" : [
{ {
"refsource": "CONFIRM", "name" : "20181112 DSA-2018-198: RSA BSAFE Micro Edition Suite Key Management Error Vulnerability",
"url": "https://seclists.org/fulldisclosure/2018/Nov/37" "refsource" : "FULLDISC",
"url" : "https://seclists.org/fulldisclosure/2018/Nov/37"
} }
] ]
}, },
"source": { "source" : {
"discovery": "UNKNOWN" "discovery" : "UNKNOWN"
} }
} }

2
2018/1xxx/CVE-2018-1800.json
View File

@ -38,7 +38,7 @@
"description_data" : [ "description_data" : [
{ {
"lang" : "eng", "lang" : "eng",
"value" : "IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period when installation is occuring. IBM X-Force ID: 149607." "value" : "IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period when installation is occurring. IBM X-Force ID: 149607."
} }
] ]
}, },

2
2018/5xxx/CVE-2018-5156.json
View File

@ -61,7 +61,7 @@
"description_data" : [ "description_data" : [
{ {
"lang" : "eng", "lang" : "eng",
"value" : "A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occuring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61." "value" : "A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61."
} }
] ]
}, },