{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "getbootstrap",
        "version": "4.3.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "virtualization manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "4.3"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "getbootstrap",
        "version": "4.3.1"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip fraud protection service",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "getbootstrap",
        "version": "3.4.1"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.1.0"
      },
      {
        "_id": null,
        "model": "big-ip application acceleration manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.0.0"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip global traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip local traffic manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip analytics",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "14.1.2.5"
      },
      {
        "_id": null,
        "model": "big-ip domain name system",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.0"
      },
      {
        "_id": null,
        "model": "big-ip link controller",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip edge gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip application security manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "big-ip advanced firewall manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "12.1.5.1"
      },
      {
        "_id": null,
        "model": "big-ip policy enforcement manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "15.0.0"
      },
      {
        "_id": null,
        "model": "big-ip webaccelerator",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.1.3.4"
      },
      {
        "_id": null,
        "model": "big-ip access policy manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "f5",
        "version": "13.0.0"
      },
      {
        "_id": null,
        "model": "tenable.sc",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "tenable",
        "version": "5.19.0"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "bootstrap",
        "version": "3.4.1"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "bootstrap",
        "version": "4.3.1"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "bootstrap",
        "version": null
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "bootstrap",
        "version": "4.3.x"
      },
      {
        "_id": null,
        "model": "cloud foundry ops manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "2.4"
      },
      {
        "_id": null,
        "model": "cloud foundry ops manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "2.3"
      },
      {
        "_id": null,
        "model": "cloud foundry ops manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "2.2"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "getbootstrap",
        "version": "4.3"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "getbootstrap",
        "version": "4.2.1"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "getbootstrap",
        "version": "4.2"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "getbootstrap",
        "version": "3.4"
      },
      {
        "_id": null,
        "model": "cloud foundry ops manager",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "2.4.5"
      },
      {
        "_id": null,
        "model": "cloud foundry ops manager",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "2.3.11"
      },
      {
        "_id": null,
        "model": "cloud foundry ops manager",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "2.2.19"
      },
      {
        "_id": null,
        "model": "bootstrap",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "getbootstrap",
        "version": "4.3.1"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "107375"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-8331"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "159852"
      },
      {
        "db": "PACKETSTORM",
        "id": "170819"
      },
      {
        "db": "PACKETSTORM",
        "id": "170155"
      },
      {
        "db": "PACKETSTORM",
        "id": "154812"
      },
      {
        "db": "PACKETSTORM",
        "id": "158750"
      },
      {
        "db": "PACKETSTORM",
        "id": "160568"
      },
      {
        "db": "PACKETSTORM",
        "id": "154810"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2019-8331",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2019-8331",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-159766",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2019-8331",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2019-8331",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-8331",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-8331",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "VULHUB",
            "id": "VHN-159766",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-159766"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-8331"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. Bootstrap Contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. \nAn  attacker may leverage this issue to execute arbitrary script code in  the browser of an unsuspecting user in the context of the affected site.  This may allow the attacker to steal cookie-based authentication  credentials and launch other attacks. \nVersions prior to Bootstrap 4.3.1 are vulnerable. Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML. Summary:\n\nAn update for the pki-core:10.6 and pki-deps:10.6 modules is now available\nfor Red Hat Enterprise Linux 8. 8) - aarch64, noarch, ppc64le, s390x, x86_64\n\n3. Description:\n\nThe Public Key Infrastructure (PKI) Core contains fundamental packages\nrequired by Red Hat Certificate System. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.3 Release Notes linked from the References section. Bugs fixed (https://bugzilla.redhat.com/):\n\n1376706 - restore SerialNumber tag in caManualRenewal xml\n1399546 - CVE-2015-9251 jquery: Cross-site scripting via cross-domain ajax requests\n1406505 - KRA ECC installation failed with shared tomcat\n1601614 - CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute\n1601617 - CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip\n1666907 - CC: Enable AIA OCSP cert checking for entire cert chain\n1668097 - CVE-2016-10735 bootstrap: XSS in the data-target attribute\n1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute\n1695901 - CVE-2019-10179 pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA\u0027s DRM agent page in authorize recovery tab\n1701972 - CVE-2019-11358 jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection\n1706521 - CA - SubjectAltNameExtInput does not display text fields to the enrollment page\n1710171 - CVE-2019-10146 pki-core: Reflected XSS in \u0027path length\u0027 constraint field in CA\u0027s Agent page\n1721684 - Rebase pki-servlet-engine to 9.0.30\n1724433 - caTransportCert.cfg  contains MD2/MD5withRSA as signingAlgsAllowed. \n1732565 - CVE-2019-10221 pki-core: Reflected XSS in getcookies?url= endpoint in CA\n1732981 - When nuxwdog is enabled pkidaemon status shows instances as stopped. \n1777579 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page\n1805541 - [RFE] CA Certificate Transparency with Embedded Signed Certificate Time stamp\n1817247 - Upgrade to 10.8.3 breaks PKI Tomcat Server\n1821851 - [RFE] Provide SSLEngine via JSSProvider for use with PKI\n1822246 - JSS - NativeProxy never calls releaseNativeResources - Memory Leak\n1824939 - JSS: add RSA PSS support - RHEL 8.3\n1824948 - add RSA PSS support - RHEL 8.3\n1825998 - CertificatePoliciesExtDefault MAX_NUM_POLICIES hardcoded limit\n1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n1842734 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA\u0027s DRM agent page in authorize recovery tab [rhel-8]\n1842736 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in \u0027path length\u0027 constraint field in CA\u0027s Agent page [rhel-8]\n1843537 - Able to Perform PKI CLI operations like cert request and approval without nssdb password\n1845447 - pkispawn fails in FIPS mode: AJP connector has secretRequired=\"true\" but no secret\n1850004 - CVE-2020-11023 jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution\n1854043 - /usr/bin/PrettyPrintCert is failing with a ClassNotFoundException\n1854959 - ca-profile-add with Netscape extensions nsCertSSLClient and nsCertEmail in the profile gets stuck in processing\n1855273 - CVE-2020-15720 pki: Dogtag\u0027s python client does not validate certificates\n1855319 - Not able to launch pkiconsole\n1856368 - kra-key-generate request is failing\n1857933 - CA Installation is failing with ncipher v12.30 HSM\n1861911 - pki cli ca-cert-request-approve hangs over crmf request from client-cert-request\n1869893 - Common certificates are missing in CS.cfg on shared PKI instance\n1871064 - replica install failing during pki-ca component configuration\n1873235 - pki ca-user-cert-add with secure port failed with \u0027SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT\u0027\n\n6. Description:\n\nRed Hat JBoss Enterprise Application Platform 7 is a platform for Java\napplications based on the WildFly application runtime. JIRA issues fixed (https://issues.jboss.org/):\n\nJBEAP-23864 - (7.4.z) Upgrade xmlsec from 2.1.7.redhat-00001 to 2.2.3.redhat-00001\nJBEAP-23865 - [GSS](7.4.z) Upgrade Apache CXF from 3.3.13.redhat-00001 to 3.4.10.redhat-00001\nJBEAP-23866 - (7.4.z) Upgrade wss4j from 2.2.7.redhat-00001 to 2.3.3.redhat-00001\nJBEAP-23928 - Tracker bug for the EAP 7.4.9 release for RHEL-9\nJBEAP-24055 - (7.4.z) Upgrade HAL from 3.3.15.Final-redhat-00001 to 3.3.16.Final-redhat-00001\nJBEAP-24081 - (7.4.z) Upgrade Elytron from 1.15.14.Final-redhat-00001 to 1.15.15.Final-redhat-00001\nJBEAP-24095 - (7.4.z) Upgrade elytron-web from 1.9.2.Final-redhat-00001 to 1.9.3.Final-redhat-00001\nJBEAP-24100 - [GSS](7.4.z) Upgrade Undertow from 2.2.20.SP1-redhat-00001 to 2.2.22.SP3-redhat-00001\nJBEAP-24127 - (7.4.z) UNDERTOW-2123 - Update AsyncContextImpl.dispatch to use proper value\nJBEAP-24128 - (7.4.z) Upgrade Hibernate Search from 5.10.7.Final-redhat-00001 to 5.10.13.Final-redhat-00001\nJBEAP-24132 - [GSS](7.4.z) Upgrade Ironjacamar from 1.5.3.SP2-redhat-00001 to 1.5.10.Final-redhat-00001\nJBEAP-24147 - (7.4.z) Upgrade jboss-ejb-client from 4.0.45.Final-redhat-00001 to 4.0.49.Final-redhat-00001\nJBEAP-24167 - (7.4.z) Upgrade WildFly Core from 15.0.19.Final-redhat-00001 to 15.0.21.Final-redhat-00002\nJBEAP-24191 - [GSS](7.4.z) Upgrade remoting from 5.0.26.SP1-redhat-00001 to 5.0.27.Final-redhat-00001\nJBEAP-24195 - [GSS](7.4.z) Upgrade JSF API from 3.0.0.SP06-redhat-00001 to 3.0.0.SP07-redhat-00001\nJBEAP-24207 - (7.4.z) Upgrade Soteria from 1.0.1.redhat-00002 to 1.0.1.redhat-00003\nJBEAP-24248 - (7.4.z) ELY-2492 - Upgrade sshd-common in Elytron from 2.7.0 to 2.9.2\nJBEAP-24426 - (7.4.z) Upgrade Elytron from 1.15.15.Final-redhat-00001 to 1.15.16.Final-redhat-00001\nJBEAP-24427 - (7.4.z) Upgrade WildFly Core from 15.0.21.Final-redhat-00002 to 15.0.22.Final-redhat-00001\n\n7. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2020:3247-01\nProduct:           Red Hat Virtualization\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:3247\nIssue date:        2020-08-04\nCVE Names:         CVE-2017-18635 CVE-2019-8331 CVE-2019-10086 \n                   CVE-2019-13990 CVE-2019-17195 CVE-2019-19336 \n                   CVE-2020-7598 CVE-2020-10775 CVE-2020-11022 \n                   CVE-2020-11023 \n=====================================================================\n\n1. Summary:\n\nUpdated ovirt-engine packages that fix several bugs and add various\nenhancements are now available. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch, x86_64\n\n3. Description:\n\nThe ovirt-engine package provides the Red Hat Virtualization Manager, a\ncentralized management platform that allows system administrators to view\nand manage virtual machines. The Manager provides a comprehensive range of\nfeatures including search capabilities, resource management, live\nmigrations, and virtual infrastructure provisioning. \n\nThe Manager is a JBoss Application Server application that provides several\ninterfaces through which the virtual environment can be accessed and\ninteracted with, including an Administration Portal, a VM Portal, and a\nRepresentational State Transfer (REST) Application Programming Interface\n(API). \n\nA list of bugs fixed in this update is available in the Technical Notes\nbook:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht\nml-single/technical_notes\n\nSecurity Fix(es):\n\n* apache-commons-beanutils: does not suppresses the class property in\nPropertyUtilsBean by default (CVE-2019-10086)\n\n* libquartz: XXE attacks via job description (CVE-2019-13990)\n\n* novnc: XSS vulnerability via the messages propagated to the status field\n(CVE-2017-18635)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute\n(CVE-2019-8331)\n\n* nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)\n\n* ovirt-engine: response_type parameter allows reflected XSS\n(CVE-2019-19336)\n\n* nodejs-minimist: prototype pollution allows adding or modifying\nproperties of Object.prototype using a constructor or __proto__ payload\n(CVE-2020-7598)\n\n* ovirt-engine: Redirect to arbitrary URL allows for phishing\n(CVE-2020-10775)\n\n* Cross-site scripting due to improper injQuery.htmlPrefilter method\n(CVE-2020-11022)\n\n* jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods\ncould result in untrusted code execution (CVE-2020-11023)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1080097 - [RFE] Allow editing disks details in the Disks tab\n1325468 - [RFE] Autostart of VMs that are down (with Engine assistance - Engine has to be up)\n1358501 - [RFE] multihost network change - notify when done\n1427717 - [RFE] Create and/or select affinity group upon VM creation. \n1475774 - RHV-M requesting four GetDeviceListVDSCommand when editing storage domain\n1507438 - not able to deploy new rhvh host when \"/tmp\" is mounted with \"noexec\" option\n1523835 - Hosted-Engine: memory hotplug does not work for engine vm\n1527843 - [Tracker] Q35 chipset support (with seabios)\n1529042 - [RFE] Changing of Cluster CPU Type does not trigger config update notification\n1535796 - Undeployment of HE is not graceful\n1546838 - [RFE] Refuse to deploy on localhost.localdomain\n1547937 - [RFE] Live Storage Migration progress bar. \n1585986 - [HE] When lowering the cluster compatibility, we need to force update the HE storage OVF store to ensure it can start up (migration will not work). \n1593800 - [RFE] forbid new mac pools with overlapping ranges\n1596178 - inconsistent display between automatic and manual Pool Type\n1600059 - [RFE] Add by default a storage lease to HA VMs\n1610212 - After updating to RHV 4.1 while trying to edit the disk, getting error \"Cannot edit Virtual Disk. Cannot edit Virtual Disk. Disk extension combined with disk compat version update isn\u0027t supported. Please perform the updates separately.\"\n1611395 - Unable to list Compute Templates in RHV 4.2 from Satellite 6.3.2\n1616451 - [UI] add a tooltip to explain the supported matrix for the combination of disk allocation policies, formats and the combination result\n1637172 - Live Merge hung in the volume deletion phase,  leaving snapshot in a LOCKED state\n1640908 - Javascript Error popup when Managing StorageDomain with LUNs and 400+ paths\n1642273 - [UI] - left nav border highlight missing in RHV\n1647440 - [RFE][UI] Provide information about the VM next run\n1648345 - Jobs are not properly cleaned after a failed task. \n1650417 - HA is broken for VMs having disks in NFS storage domain because of Qemu OFD locking\n1650505 - Increase of ClusterCompatibilityVersion to Cluster with virtual machines with outstanding configuration changes, those changes will be reverted\n1651406 - [RFE] Allow Maintenance of Host with Enforcing VM Affinity Rules (hard affinity)\n1651939 - a new size of the direct LUN not updated in Admin Portal\n1654069 - [Downstream Clone] [UI] - grids bottom scrollbar hides bottom row\n1654889 - [RFE] Support console VNC for mediated devices\n1656621 - Importing VM OVA always enables \u0027Cloud-Init/Sysprep\u0027\n1658101 - [RESTAPI] Adding ISO disables serial console\n1659161 - Unable to edit pool that is delete protected\n1660071 - Regression in Migration of VM that starts in pause mode: took 11 hours\n1660644 - Concurrent LSMs of the same disk can be issued via the REST-API\n1663366 - USB selection option disabled even though USB support is enabled in RHV-4.2\n1664479 - Third VM fails to get migrated when host is placed into maintenance mode\n1666913 - [UI] warn users about different \"Vdsm Name\" when creating network with a fancy char or long name\n1670102 - [CinderLib] - openstack-cinder and cinderlib packages are not installed on ovirt-engine machine\n1671876 - \"Bond Active Slave\" parameter on RHV-M GUI shows an incorrect until Refresh Caps\n1679039 - Unable to upload image through Storage-\u003eDomain-\u003eDisk because of wrong DC\n1679110 - [RFE] change Admin Portal toast notifications location\n1679471 - [ja, de, es, fr, pt_BR] The console client resources page shows truncated title for some locales\n1679730 - Warn about host IP addresses outside range\n1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute\n1686650 - Memory snapshots\u0027 deletion logging unnecessary WARNINGS in engine.log\n1687345 - Snapshot with memory volumes can fail if the memory dump takes more than 180 seconds\n1690026 - [RFE] - Creating an NFS storage domain the engine should let the user specify exact NFS version v4.0 and not just v4\n1690155 - Disk migration progress bar not clearly visible and unusable. \n1690475 - When a live storage migration fails, the auto generated snapshot does not get removed\n1691562 - Cluster level changes are not increasing VMs generation numbers and so a new OVF_STORE content is not copied to the shared storage\n1692592 - \"\ufffcEnable menu to select boot device shows 10 device listed with cdrom at 10th slot but when selecting 10 option the VM took 1 as option and boot with disk\n1693628 - Engine generates too many updates to vm_dynamic table due to the session change\n1693813 - Do not change DC level if there are VMs running/paused with older CL. \n1695026 - Failure in creating snapshots during \"Live Storage Migration\" can result in a nonexistent snapshot\n1695635 - [RFE] Improve Host Drop-down menu in different Dialogs (i.e. Alphabetical sort of Hosts in Remove|New StorageDomains)\n1696245 - [RFE] Allow full customization while cloning a VM\n1696669 - Build bouncycastle for RHV 4.4 RHEL 8\n1696676 - Build ebay-cors-filter for RHV 4.4 RHEL 8\n1698009 - Build openstack-java-sdk for RHV 4.4 RHEL 8\n1698102 - Print a warning message to engine-setup, which highlights that other clusters than the Default one are not modified to use ovirt-provider-ovn as the default network provider\n1700021 - [RFE] engine-setup should warn and prompt if ca.pem is missing but other generated pki files exist\n1700036 - [RFE] Add RedFish API for host power management for RHEV\n1700319 - VM is going to pause state with \"storage I/O  error\". \n1700338 - [RFE] Alternate method to configure the email Event Notifier for a user in RHV through API (instead of  RHV GUI)\n1700725 - [scale] RHV-M runs out of memory due to to much data reported by the guest agent\n1700867 - Build makeself for RHV 4.4 RHEL 8\n1701476 - Build unboundid-ldapsdk for RHV 4.4 RHEL 8\n1701491 - Build RHV-M 4.4 - RHEL 8\n1701522 - Build ovirt-imageio-proxy for RHV 4.4 / RHEL 8\n1701528 - Build / Tag python-ovsdbapp for RHV 4.4 RHEL 8\n1701530 - Build / Tag ovirt-cockpit-sso for RHV 4.4 RHEL 8\n1701531 - Build / Tag ovirt-engine-api-explorer for RHV 4.4 RHEL 8\n1701533 - Build / Tag ovirt-engine-dwh for RHV 4.4 / RHEL 8\n1701538 - Build / Tag vdsm-jsonrpc-java for RHV 4.4 RHEL 8\n1701544 - Build rhvm-dependencies for RHV 4.4 RHEL 8\n1702310 - Build / Tag ovirt-engine-ui-extensions for RHV 4.4 RHEL 8\n1702312 - Build ovirt-log-collector for RHV 4.4 RHEL 8\n1703112 - PCI address of NICs are not stored in the database after a hotplug of passthrough NIC resulting in change of network device name in VM after a reboot\n1703428 - VMs migrated from KVM to RHV show warning \u0027The latest guest agent needs to be installed and running on the guest\u0027\n1707225 - [cinderlib] Cinderlib DB is missing a backup and restore option\n1708624 - Build rhvm-setup-plugins for RHV 4.4 - RHEL 8\n1710491 - No EVENT_ID is generated in /var/log/ovirt-engine/engine.log when VM is rebooted from OS level itself. \n1711006 - Metrics installation fails during the execution of playbook ovirt-metrics-store-installation if the environment is not having DHCP\n1712255 - Drop 4.1 datacenter/cluster level\n1712746 - [RFE] Ignition support for ovirt vms\n1712890 - engine-setup should check for snapshots in unsupported CL\n1714528 - Missing IDs on cluster upgrade buttons\n1714633 - Using more than one asterisk in the search string is not working when searching for users. \n1714834 - Cannot disable SCSI passthrough using API\n1715725 - Sending credentials in query string logs them in ovirt-request-logs\n1716590 - [RFE][UX] Make Cluster-wide \"Custom serial number policy\" value visible at VM level\n1718818 - [RFE] Enhance local disk passthrough\n1720686 - Tag ovirt-scheduler-proxy for RHV 4.4 RHEL 8\n1720694 - Build ovirt-engine-extension-aaa-jdbc for RHV 4.4 RHEL 8\n1720795 - New guest tools are available mark in case of guest tool located on Data Domain\n1724959 - RHV recommends reporting issues to GitHub rather than access.redhat.com (ovirt-\u003eRHV rebrand glitch?)\n1727025 - NPE in DestroyImage endAction during live merge leaving a task in DB for hours causing operations depending on host clean tasks to fail as Deactivate host/StopSPM/deactivate SD\n1728472 - Engine reports network out of sync due to ipv6 default gateway via ND RA on a non default route network. \n1729511 - engine-setup fails to upgrade to 4.3 with Unicode characters in CA subject\n1729811 - [scale] updatevmdynamic broken if too many users logged in - psql ERROR: value too long for type character varying(255)\n1730264 - VMs will fail to start if the vnic profile attached is having port mirroring enabled and have name greater than 15 characters\n1730436 - Snapshot creation was successful, but snapshot remains locked\n1731212 - RHV 4.4 landing page does not show login or allow scrolling. \n1731590 - Cannot preview snapshot, it fails and VM remains locked. \n1733031 - [RFE] Add warning when importing data domains to newer DC that may trigger SD format upgrade\n1733529 - Consume python-ovsdbapp dependencies from OSP in RHEL 8 RHV 4.4\n1733843 - Export to OVA fails if VM is running on the Host doing the export\n1734839 - Unable to start guests in our Power9 cluster without running in headless mode. \n1737234 - Attach a non-existent ISO to vm by the API return 201 and marks the Attach CD checkbox as ON\n1737684 - Engine deletes the leaf volume when SnapshotVDSCommand timed out without checking if the  volume is still used by the VM\n1740978 - [RFE] Warn or Block importing VMs/Templates from unsupported compatibility levels. \n1741102 - host activation causes RHHI nodes to lose the quorum\n1741271 - Move/Copy disk are blocked if there is less space in source SD than the size of the disk\n1741625 - VM fails to be re-started with error: Failed to acquire lock: No space left on device\n1743690 - Commit and Undo buttons active when no snapshot selected\n1744557 - RHV 4.3 throws an exception when trying to access VMs which have snapshots from unsupported compatibility levels\n1745384 - [IPv6 Static] Engine should allow updating network\u0027s static ipv6gateway\n1745504 - Tag rhv-log-collector-analyzer for RHV 4.4 RHEL 8\n1746272 - [BREW BUILD ENABLER] Build the oVirt Ansible roles for RHV 4.4.0\n1746430 - [Rebase] Rebase v2v-conversion-host for RHV 4.4 Engine\n1746877 - [Metrics] Rebase bug - for the 4.4 release on EL8\n1747772 - Extra white space at the top of webadmin dialogs\n1749284 - Change the Snapshot operation to be asynchronous\n1749944 - teardownImage attempts to deactivate in-use LV\u0027s rendering the VM disk image/volumes in locked state. \n1750212 - MERGE_STATUS fails with \u0027Invalid UUID string: mapper\u0027 when Direct LUN that already exists is hot-plugged\n1750348 - [Tracking] rhvm-branding-rhv for RHV 4.4\n1750357 - [Tracking] ovirt-web-ui for RHV 4.4\n1750371 - [Tracking] ovirt-engine-ui-extensions for RHV 4.4\n1750482 - From  VM Portal, users cannot create Operating System Windows VM. \n1751215 - Unable to change Graphical Console of HE VM. \n1751268 - add links to Insights to landing page\n1751423 - Improve description of shared memory statistics and remove unimplemented memory metrics from API\n1752890 - Build / Tag ovirt-engine-extension-aaa-ldap for RHV 4.4 RHEL 8\n1752995 - [RFE] Need to be able to set default console option\n1753629 - Build / Tag ovirt-engine-extension-aaa-misc for RHV 4.4 RHEL 8\n1753661 - Build / Tag ovirt-engine-extension-logger-log4j got RHV 4.4 / RHEl 8\n1753664 - Build ovirt-fast-forward-upgrade for RHV 4.4 /RHEL 8 support\n1754363 - [Scale] Engine generates excessive amount of dns configuration related sql queries\n1754490 - RHV Manager cannot start on EAP 7.2.4\n1755412 - Setting \"oreg_url: registry.redhat.io\" fails with error\n1758048 - clone(as thin) VM from template or create snapshot fails with \u0027Requested capacity 1073741824 \u003c parent capacity 3221225472 (volume:1211)\u0027\n1758289 - [Warn] Duplicate chassis entries in southbound database if the host is down while removing the host from Manager\n1762281 - Import of OVA created from template fails with java.lang.NullPointerException\n1763992 - [RFE] Show \"Open Console\" as the main option in the VM actions menu\n1764289 - Document details how each fence agent can be configured in RESTAPI\n1764791 - CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT\n1764932 - [BREW BUILD ENABLER] Build the ansible-runner-service for RHV 4.4\n1764943 - Create Snapshot does not proceed beyond CreateVolume\n1764959 - Apache is configured to offer TRACE method (security)\n1765660 - CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field\n1767319 - [RFE] forbid updating mac pool that contains ranges overlapping with any mac range in the system\n1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default\n1768707 - Cannot set or update iscsi portal group tag when editing storage connection via API\n1768844 - RHEL Advanced virtualization module streams support\n1769463 - [Scale] Slow performance for api/clusters when many networks devices are present\n1770237 - Cannot assign a vNIC profile for VM instance profile. \n1771793 - VM Portal crashes in what appears to be a permission related problem. \n1773313 - RHV Metric store installation fails with error: \"You need to install \\\"jmespath\\\" prior to running json_query filter\"\n1777954 - VM Templates greater then 101 quantity are not listed/reported in RHV-M Webadmin UI. \n1779580 - drop rhvm-doc package\n1781001 - CVE-2019-19336 ovirt-engine: response_type parameter allows reflected XSS\n1782236 - Windows Update (the drivers) enablement\n1782279 - Warning message for low space is not received on Imported Storage domain\n1782882 - qemu-kvm: kvm_init_vcpu failed: Function not implemented\n1784049 - Rhel6 guest with cluster default q35 chipset causes kernel panic\n1784385 - Still requiring rhvm-doc in rhvm-setup-plugins\n1785750 - [RFE] Ability to change default VM action (Suspend) in the VM Portal. \n1788424 - Importing a VM having direct LUN attached using virtio driver is failing with error \"VirtIO-SCSI is disabled for the VM\"\n1796809 - Build apache-sshd for RHV 4.4 RHEL 8\n1796811 - Remove bundled apache-sshd library\n1796815 - Build snmp4j for RHV 4.4 RHEL 8\n1796817 - Remove bundled snmp4j library\n1797316 - Snapshot creation from VM fails on second snapshot and afterwords\n1797500 - Add disk operation failed to complete. \n1798114 - Build apache-commons-digester for RHV 4.4 RHEL 8\n1798117 - Build apache-commons-configuration for RHV 4.4 RHEL 8\n1798120 - Build apache-commons-jexl for RHV 4.4 RHEL 8\n1798127 - Build apache-commons-collections4 for RHV 4.4 RHEL 8\n1798137 - Build apache-commons-vfs for RHV 4.4 RHEL 8\n1799171 - Build ws-commons-util for RHV 4.4 RHEL 8\n1799204 - Build xmlrpc for RHV 4.4 RHEL 8\n1801149 - CVE-2019-13990 libquartz: XXE attacks via job description\n1801709 - Disable activation of the host while Enroll certificate flow is still in progress\n1803597 - rhv-image-discrepancies should skip storage domains in maintenance mode and ISO/Export\n1805669 - change requirement on rhvm package from spice-client-msi to spice-client-win\n1806276 - [HE] ovirt-provider-ovn is non-functional on 4.3.9 Hosted-Engine\n1807047 - Build m2crypto for RHV 4.4 RHEL 8\n1807860 - [RFE] Allow resource allocation options to be customized\n1808096 - Uploading ISOs causes \"Uncaught exception occurred. Please try reloading the page. Details: (TypeError) : a.n is null\"\n1808126 - host_service.install() does not work with deploy_hosted_engine as True. \n1809040 - [CNV\u0026RHV] let the user know that token is not valid anymore\n1809052 - [CNV\u0026RHV] ovirt-engine log file spammed by failed timers ( approx 3-5 messages/sec )\n1809875 - rhv-image-discrepancies only compares images on the last DC\n1809877 - rhv-image-discrepancies sends dump-volume-chains with parameter that is ignored\n1810893 - mountOptions is ignored for \"import storage domain\" from GUI\n1811865 - [Scale] Host Monitoring generates excessive amount of qos related sql queries\n1811869 - [Scale] Webadmin\\REST for host interface list response time is too long because of excessive amount of qos related sql queries\n1812875 - Unable to create VMs  when french Language is selected  for the rhvm gui. \n1813305 - Engine updating SLA policies of VMs continuously in  an environment which is not having any QOS configured\n1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload\n1814197 - [CNV\u0026RHV] when provider is remover DC is left behind and active\n1814215 - [CNV\u0026RHV] Adding new provider to engine fails after succesfull test\n1816017 - Build log4j12 for RHV 4.4 EL8\n1816643 - [CNV\u0026RHV] VM created in CNV not visible in RHV\n1816654 - [CNV\u0026RHV] adding provider with already created vm failed\n1816693 - [CNV\u0026RHV] CNV VM failed to restart even if 1st dialog looks fine\n1816739 - [CNV\u0026RHV] CNV VM updated form CNV side doesn\u0027t update vm properties over on RHV side\n1817467 - [Tracking] Migration path between RHV 4.3 and 4.4\n1818745 - rhv-log-collector-analyzer 0.2.17 still requires pyhton2\n1819201 - [CodeChange][i18n] oVirt 4.4 rhv branding - translation update\n1819248 - Cannot upgrade host after engine setup\n1819514 - Failed to register 4.4 host to the latest engine (4.4.0-0.29.master.el8ev)\n1819960 - NPE on ImportVmTemplateFromConfigurationCommand when creating VM from ovf_data\n1820621 - Build apache-commons-compress for RHV 4.4 EL8\n1820638 - Build apache-commons-jxpath for RHV 4.4 EL8\n1821164 - Failed snapshot creation can cause data corruption of other VMs\n1821930 - Enable only TLSv1.2+ protocol for SPICE on EL7 hosts\n1824095 - VM portal shows only error\n1825793 - RHV branding is missing after upgrade from 4.3\n1826248 - [4.4][ovirt-cockpit-sso] Compatibility issues with python3\n1826437 - The console client resources page return HTTP code 500\n1826801 - [CNV\u0026RHV] update of memory on cnv side does not propagate to rhv\n1826855 - [cnv\u0026rhv] update of cpu on cnv side causing expetion in engine.log\n1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n1828669 - After SPM select the engine lost communication to all hosts until restarted [improved logging]\n1828736 - [CNV\u0026RHV] cnv template is not propagated to rhv\n1829189 - engine-setup httpd ssl configuration conflicts with Red Hat Insights\n1829656 - Failed to register 4.3 host to 4.4 engine with 4.3 cluster (4.4.0-0.33.master.el8ev)\n1829830 - vhost custom properties does not accept \u0027-\u0027\n1832161 - rhv-log-collector-analyzer fails with UnicodeDecodeError on RHEL8\n1834523 - Edit VM -\u003e Enable Smartcard sharing does not stick when VM is running\n1838493 - Live snapshot made with freeze in the engine will cause the FS to be frozen\n1841495 - Upgrade openstack-java-sdk to 3.2.9\n1842495 - high cpu usage after entering wrong search pattern in RHVM\n1844270 - [vGPU] nodisplay option for mdev broken since mdev scheduling unit\n1844855 - Missing images (favicon.ico, banner logo) and missing brand.css file on VM portal d/s installation\n1845473 - Exporting an OVA file from a VM results in its ovf file having a format of RAW when the disk is COW\n1847420 - CVE-2020-10775 ovirt-engine: Redirect to arbitrary URL allows for phishing\n1850004 - CVE-2020-11023 jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution\n1853444 - [CodeChange][i18n] oVirt 4.4 rhv branding - translation update (July-2020)\n1854563 - [4.4 downstream only][RFE] Include a link to grafana on front page\n\n6. Package List:\n\nRHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:\n\nSource:\nansible-runner-1.4.5-1.el8ar.src.rpm\nansible-runner-service-1.0.2-1.el8ev.src.rpm\napache-commons-collections4-4.4-1.el8ev.src.rpm\napache-commons-compress-1.18-1.el8ev.src.rpm\napache-commons-configuration-1.10-1.el8ev.src.rpm\napache-commons-jexl-2.1.1-1.el8ev.src.rpm\napache-commons-jxpath-1.3-29.el8ev.src.rpm\napache-commons-vfs-2.4.1-1.el8ev.src.rpm\napache-sshd-2.5.1-1.el8ev.src.rpm\nebay-cors-filter-1.0.1-4.el8ev.src.rpm\ned25519-java-0.3.0-1.el8ev.src.rpm\nengine-db-query-1.6.1-1.el8ev.src.rpm\njava-client-kubevirt-0.5.0-1.el8ev.src.rpm\nlog4j12-1.2.17-22.el8ev.src.rpm\nm2crypto-0.35.2-5.el8ev.src.rpm\nmakeself-2.4.0-4.el8ev.src.rpm\nnovnc-1.1.0-1.el8ost.src.rpm\nopenstack-java-sdk-3.2.9-1.el8ev.src.rpm\novirt-cockpit-sso-0.1.4-1.el8ev.src.rpm\novirt-engine-4.4.1.8-0.7.el8ev.src.rpm\novirt-engine-api-explorer-0.0.6-1.el8ev.src.rpm\novirt-engine-dwh-4.4.1.2-1.el8ev.src.rpm\novirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.src.rpm\novirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.src.rpm\novirt-engine-extension-aaa-misc-1.1.0-1.el8ev.src.rpm\novirt-engine-extension-logger-log4j-1.1.0-1.el8ev.src.rpm\novirt-engine-extensions-api-1.0.1-1.el8ev.src.rpm\novirt-engine-metrics-1.4.1.1-1.el8ev.src.rpm\novirt-engine-ui-extensions-1.2.2-1.el8ev.src.rpm\novirt-fast-forward-upgrade-1.1.6-0.el8ev.src.rpm\novirt-log-collector-4.4.2-1.el8ev.src.rpm\novirt-scheduler-proxy-0.1.9-1.el8ev.src.rpm\novirt-web-ui-1.6.3-1.el8ev.src.rpm\npython-aniso8601-0.82-4.el8ost.src.rpm\npython-flask-1.0.2-2.el8ost.src.rpm\npython-flask-restful-0.3.6-8.el8ost.src.rpm\npython-netaddr-0.7.19-8.1.el8ost.src.rpm\npython-notario-0.0.16-2.el8cp.src.rpm\npython-ovsdbapp-0.17.1-0.20191216120142.206cf14.el8ost.src.rpm\npython-pbr-5.1.2-2.el8ost.src.rpm\npython-six-1.12.0-1.el8ost.src.rpm\npython-websocket-client-0.54.0-1.el8ost.src.rpm\npython-werkzeug-0.16.0-1.el8ost.src.rpm\nrhv-log-collector-analyzer-1.0.2-1.el8ev.src.rpm\nrhvm-branding-rhv-4.4.4-1.el8ev.src.rpm\nrhvm-dependencies-4.4.0-1.el8ev.src.rpm\nrhvm-setup-plugins-4.4.2-1.el8ev.src.rpm\nsnmp4j-2.4.1-1.el8ev.src.rpm\nunboundid-ldapsdk-4.0.14-1.el8ev.src.rpm\nvdsm-jsonrpc-java-1.5.4-1.el8ev.src.rpm\nws-commons-util-1.0.2-1.el8ev.src.rpm\nxmlrpc-3.1.3-1.el8ev.src.rpm\n\nnoarch:\nansible-runner-1.4.5-1.el8ar.noarch.rpm\nansible-runner-service-1.0.2-1.el8ev.noarch.rpm\napache-commons-collections4-4.4-1.el8ev.noarch.rpm\napache-commons-collections4-javadoc-4.4-1.el8ev.noarch.rpm\napache-commons-compress-1.18-1.el8ev.noarch.rpm\napache-commons-compress-javadoc-1.18-1.el8ev.noarch.rpm\napache-commons-configuration-1.10-1.el8ev.noarch.rpm\napache-commons-jexl-2.1.1-1.el8ev.noarch.rpm\napache-commons-jexl-javadoc-2.1.1-1.el8ev.noarch.rpm\napache-commons-jxpath-1.3-29.el8ev.noarch.rpm\napache-commons-jxpath-javadoc-1.3-29.el8ev.noarch.rpm\napache-commons-vfs-2.4.1-1.el8ev.noarch.rpm\napache-commons-vfs-ant-2.4.1-1.el8ev.noarch.rpm\napache-commons-vfs-examples-2.4.1-1.el8ev.noarch.rpm\napache-commons-vfs-javadoc-2.4.1-1.el8ev.noarch.rpm\napache-sshd-2.5.1-1.el8ev.noarch.rpm\napache-sshd-javadoc-2.5.1-1.el8ev.noarch.rpm\nebay-cors-filter-1.0.1-4.el8ev.noarch.rpm\ned25519-java-0.3.0-1.el8ev.noarch.rpm\ned25519-java-javadoc-0.3.0-1.el8ev.noarch.rpm\nengine-db-query-1.6.1-1.el8ev.noarch.rpm\njava-client-kubevirt-0.5.0-1.el8ev.noarch.rpm\nlog4j12-1.2.17-22.el8ev.noarch.rpm\nlog4j12-javadoc-1.2.17-22.el8ev.noarch.rpm\nmakeself-2.4.0-4.el8ev.noarch.rpm\nnovnc-1.1.0-1.el8ost.noarch.rpm\nopenstack-java-ceilometer-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-ceilometer-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-cinder-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-cinder-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-glance-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-glance-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-heat-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-heat-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-javadoc-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-keystone-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-keystone-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-nova-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-nova-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-quantum-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-quantum-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-resteasy-connector-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-swift-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-swift-model-3.2.9-1.el8ev.noarch.rpm\novirt-cockpit-sso-0.1.4-1.el8ev.noarch.rpm\novirt-engine-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-api-explorer-0.0.6-1.el8ev.noarch.rpm\novirt-engine-backend-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-dbscripts-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-dwh-4.4.1.2-1.el8ev.noarch.rpm\novirt-engine-dwh-grafana-integration-setup-4.4.1.2-1.el8ev.noarch.rpm\novirt-engine-dwh-setup-4.4.1.2-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-ldap-setup-1.4.0-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-misc-1.1.0-1.el8ev.noarch.rpm\novirt-engine-extension-logger-log4j-1.1.0-1.el8ev.noarch.rpm\novirt-engine-extensions-api-1.0.1-1.el8ev.noarch.rpm\novirt-engine-extensions-api-javadoc-1.0.1-1.el8ev.noarch.rpm\novirt-engine-health-check-bundler-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-metrics-1.4.1.1-1.el8ev.noarch.rpm\novirt-engine-restapi-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-base-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-cinderlib-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-imageio-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-ovirt-engine-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-ovirt-engine-common-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-vmconsole-proxy-helper-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-websocket-proxy-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-tools-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-tools-backup-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-ui-extensions-1.2.2-1.el8ev.noarch.rpm\novirt-engine-vmconsole-proxy-helper-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-webadmin-portal-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-websocket-proxy-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-fast-forward-upgrade-1.1.6-0.el8ev.noarch.rpm\novirt-log-collector-4.4.2-1.el8ev.noarch.rpm\novirt-scheduler-proxy-0.1.9-1.el8ev.noarch.rpm\novirt-web-ui-1.6.3-1.el8ev.noarch.rpm\npython-flask-doc-1.0.2-2.el8ost.noarch.rpm\npython2-netaddr-0.7.19-8.1.el8ost.noarch.rpm\npython2-pbr-5.1.2-2.el8ost.noarch.rpm\npython2-six-1.12.0-1.el8ost.noarch.rpm\npython3-aniso8601-0.82-4.el8ost.noarch.rpm\npython3-ansible-runner-1.4.5-1.el8ar.noarch.rpm\npython3-flask-1.0.2-2.el8ost.noarch.rpm\npython3-flask-restful-0.3.6-8.el8ost.noarch.rpm\npython3-netaddr-0.7.19-8.1.el8ost.noarch.rpm\npython3-notario-0.0.16-2.el8cp.noarch.rpm\npython3-ovirt-engine-lib-4.4.1.8-0.7.el8ev.noarch.rpm\npython3-ovsdbapp-0.17.1-0.20191216120142.206cf14.el8ost.noarch.rpm\npython3-pbr-5.1.2-2.el8ost.noarch.rpm\npython3-six-1.12.0-1.el8ost.noarch.rpm\npython3-websocket-client-0.54.0-1.el8ost.noarch.rpm\npython3-werkzeug-0.16.0-1.el8ost.noarch.rpm\npython3-werkzeug-doc-0.16.0-1.el8ost.noarch.rpm\nrhv-log-collector-analyzer-1.0.2-1.el8ev.noarch.rpm\nrhvm-4.4.1.8-0.7.el8ev.noarch.rpm\nrhvm-branding-rhv-4.4.4-1.el8ev.noarch.rpm\nrhvm-dependencies-4.4.0-1.el8ev.noarch.rpm\nrhvm-setup-plugins-4.4.2-1.el8ev.noarch.rpm\nsnmp4j-2.4.1-1.el8ev.noarch.rpm\nsnmp4j-javadoc-2.4.1-1.el8ev.noarch.rpm\nunboundid-ldapsdk-4.0.14-1.el8ev.noarch.rpm\nunboundid-ldapsdk-javadoc-4.0.14-1.el8ev.noarch.rpm\nvdsm-jsonrpc-java-1.5.4-1.el8ev.noarch.rpm\nws-commons-util-1.0.2-1.el8ev.noarch.rpm\nws-commons-util-javadoc-1.0.2-1.el8ev.noarch.rpm\nxmlrpc-client-3.1.3-1.el8ev.noarch.rpm\nxmlrpc-common-3.1.3-1.el8ev.noarch.rpm\nxmlrpc-javadoc-3.1.3-1.el8ev.noarch.rpm\nxmlrpc-server-3.1.3-1.el8ev.noarch.rpm\n\nx86_64:\nm2crypto-debugsource-0.35.2-5.el8ev.x86_64.rpm\npython3-m2crypto-0.35.2-5.el8ev.x86_64.rpm\npython3-m2crypto-debuginfo-0.35.2-5.el8ev.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-18635\nhttps://access.redhat.com/security/cve/CVE-2019-8331\nhttps://access.redhat.com/security/cve/CVE-2019-10086\nhttps://access.redhat.com/security/cve/CVE-2019-13990\nhttps://access.redhat.com/security/cve/CVE-2019-17195\nhttps://access.redhat.com/security/cve/CVE-2019-19336\nhttps://access.redhat.com/security/cve/CVE-2020-7598\nhttps://access.redhat.com/security/cve/CVE-2020-10775\nhttps://access.redhat.com/security/cve/CVE-2020-11022\nhttps://access.redhat.com/security/cve/CVE-2020-11023\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXylir9zjgjWX9erEAQii/A//bJm3u0+ul+LdQwttSJJ79OdVqcp3FktP\ntdPj8AFbB6F9KkuX9FAQja0/2pgZAldB3Eyz57GYTxyDD1qeMqYSayGHCH01GWAn\nu8uF90lcSz6YvgEPDh1mWhLYQMfdWT6IUuKOEHldt8TyHbc7dX3xCbsLDzNCxGbl\nQuPSFPQBJaAXETSw42NGzdUzaM9zoQ0Mngj+Owcgw53YyBy3BSLAb5bKuijvkcLy\nSVCAxxiQ89E+cnETKYIv4dOfqXGA5wLg68hDmUQyFcXHA9nQbJM9Q0s1fbZ2Wav1\noGGTqJDTgVElxrHB5pYJ6pu484ZgJealkBCrHA2OBsMJUadwitVvQLXFZF5OyN0N\nf/vtZ1ua4mZADa61qfnlmVRiyISwmPPWIOImA3TIE5Q8Yl5ucCqtDjQPoJAbXsUl\nY22Bb5x7JyrN0nyOgwh6BGGK51CmOaP+xNuWD7osI24pnzdmPTZuJrZLePxgPgac\nWWQNznzvokknva2ofvujAm+DEl+W7W3A8Vs9wkmUWYlaVC7GFLEkcvQjjHahZ7kh\ndVJNoh70vpA+aJCMQHYK6MGtCSAWoqXkRTsHb3Stfm2vLLz6GYxY5OuvB7Z0ME1N\nzCiFjBla5+3nKx5ab8Pola56T1wRULHL6zYN9GTsOzxjdJsKHXBVeV8OYcnoHiza\n2TrKn2dtZwI=\n=92Q3\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. Description:\n\npython-XStatic-Bootstrap-SCSS is the Bootstrap-SCSS JavaScript library\npackaged for setuptools / pip. Relevant releases/architectures:\n\nRHV-M 4.3 - noarch\n\n3. Description:\n\nThe ovirt-engine-ui-extensions package contains UI plugins that provide\nvarious extensions to the oVirt administration UI. \n\nBug Fix(es):\n\n* Known moderate severity security vulnerability detected by GitHub on\novirt-engine-ui-extensions components (BZ#1694035)\n\n4",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-8331"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      },
      {
        "db": "BID",
        "id": "107375"
      },
      {
        "db": "VULHUB",
        "id": "VHN-159766"
      },
      {
        "db": "PACKETSTORM",
        "id": "159852"
      },
      {
        "db": "PACKETSTORM",
        "id": "170819"
      },
      {
        "db": "PACKETSTORM",
        "id": "170155"
      },
      {
        "db": "PACKETSTORM",
        "id": "154812"
      },
      {
        "db": "PACKETSTORM",
        "id": "158750"
      },
      {
        "db": "PACKETSTORM",
        "id": "160568"
      },
      {
        "db": "PACKETSTORM",
        "id": "154810"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-8331",
        "trust": 3.7
      },
      {
        "db": "BID",
        "id": "107375",
        "trust": 1.4
      },
      {
        "db": "PACKETSTORM",
        "id": "156743",
        "trust": 1.1
      },
      {
        "db": "TENABLE",
        "id": "TNS-2021-14",
        "trust": 1.1
      },
      {
        "db": "JVN",
        "id": "JVNVU94912830",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "159852",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "160568",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "170819",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "170155",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "158750",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "170823",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "170821",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "159876",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "159353",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "170817",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "170042",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "170154",
        "trust": 0.1
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201902-770",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-159766",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "154812",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "154810",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-159766"
      },
      {
        "db": "BID",
        "id": "107375"
      },
      {
        "db": "PACKETSTORM",
        "id": "159852"
      },
      {
        "db": "PACKETSTORM",
        "id": "170819"
      },
      {
        "db": "PACKETSTORM",
        "id": "170155"
      },
      {
        "db": "PACKETSTORM",
        "id": "154812"
      },
      {
        "db": "PACKETSTORM",
        "id": "158750"
      },
      {
        "db": "PACKETSTORM",
        "id": "160568"
      },
      {
        "db": "PACKETSTORM",
        "id": "154810"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-8331"
      }
    ]
  },
  "id": "VAR-201902-0360",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-159766"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2026-03-09T21:59:10.534000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "v3.4.1",
        "trust": 0.8,
        "url": "https://github.com/twbs/bootstrap/pull/28236"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.1
      },
      {
        "problemtype": "Cross-site scripting (CWE-79) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-159766"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-8331"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8331"
      },
      {
        "trust": 1.4,
        "url": "https://github.com/twbs/bootstrap/pull/28236"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2019:3023"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2019:3024"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/107375"
      },
      {
        "trust": 1.1,
        "url": "https://seclists.org/bugtraq/2019/may/18"
      },
      {
        "trust": 1.1,
        "url": "https://www.tenable.com/security/tns-2021-14"
      },
      {
        "trust": 1.1,
        "url": "https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/"
      },
      {
        "trust": 1.1,
        "url": "https://support.f5.com/csp/article/k24383845"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2019/may/13"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2019/may/11"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2019/may/10"
      },
      {
        "trust": 1.1,
        "url": "http://packetstormsecurity.com/files/156743/octobercms-insecure-dependencies.html"
      },
      {
        "trust": 1.1,
        "url": "https://github.com/twbs/bootstrap/releases/tag/v3.4.1"
      },
      {
        "trust": 1.1,
        "url": "https://github.com/twbs/bootstrap/releases/tag/v4.3.1"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2019:1456"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3cdev.flink.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3cissues.drill.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3cdev.drill.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3cuser.flink.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3cuser.flink.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3cdev.superset.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3cissues.hbase.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3cdev.drill.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://support.f5.com/csp/article/k24383845?utm_source=f5support\u0026amp%3butm_medium=rss"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3cuser.flink.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu94912830/"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2019-8331"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.7,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.5,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2019-11358"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-10735"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11358"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2016-10735"
      },
      {
        "trust": 0.3,
        "url": "https://github.com/twbs/bootstrap/releases"
      },
      {
        "trust": 0.3,
        "url": "https://getbootstrap.com/"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.3,
        "url": "https://pivotal.io/security/cve-2019-8331"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2018-14042"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11023"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14042"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-11023"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11022"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2020-11022"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/articles/2974891"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2015-9251"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-14040"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-9251"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14040"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.2,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20677"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-20676"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-20677"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20676"
      },
      {
        "trust": 0.1,
        "url": "https://support.f5.com/csp/article/k24383845?utm_source=f5support\u0026amp;amp;utm_medium=rss"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3cdev.drill.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3cdev.drill.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3cissues.drill.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3cdev.flink.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3cuser.flink.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3cuser.flink.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3cuser.flink.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@%3cissues.hbase.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3cdev.superset.apache.org%3e"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1721"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10146"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10221"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1721"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15720"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-15720"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10146"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10179"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10179"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10221"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:4847"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-40150"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2023:0554"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-3143"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-42003"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-42004"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14041"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-40150"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-45047"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18214"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-40152"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-40149"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-40149"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-40152"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-14041"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-18214"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-45693"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-46364"
      },
      {
        "trust": 0.1,
        "url": "https://issues.jboss.org/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2022-3143"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:8848"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10744"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10744"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-13990"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-7598"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10775"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17195"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-18635"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-7598"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:3247"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10086"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10086"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-19336"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13990"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-17195"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18635"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10775"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:5571"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-159766"
      },
      {
        "db": "BID",
        "id": "107375"
      },
      {
        "db": "PACKETSTORM",
        "id": "159852"
      },
      {
        "db": "PACKETSTORM",
        "id": "170819"
      },
      {
        "db": "PACKETSTORM",
        "id": "170155"
      },
      {
        "db": "PACKETSTORM",
        "id": "154812"
      },
      {
        "db": "PACKETSTORM",
        "id": "158750"
      },
      {
        "db": "PACKETSTORM",
        "id": "160568"
      },
      {
        "db": "PACKETSTORM",
        "id": "154810"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-8331"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-159766",
        "ident": null
      },
      {
        "db": "BID",
        "id": "107375",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "159852",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "170819",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "170155",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "154812",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "158750",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "160568",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "154810",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2019-8331",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2019-02-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-159766",
        "ident": null
      },
      {
        "date": "2019-03-07T00:00:00",
        "db": "BID",
        "id": "107375",
        "ident": null
      },
      {
        "date": "2020-11-04T15:29:15",
        "db": "PACKETSTORM",
        "id": "159852",
        "ident": null
      },
      {
        "date": "2023-01-31T17:19:24",
        "db": "PACKETSTORM",
        "id": "170819",
        "ident": null
      },
      {
        "date": "2022-12-08T16:28:14",
        "db": "PACKETSTORM",
        "id": "170155",
        "ident": null
      },
      {
        "date": "2019-10-11T15:03:31",
        "db": "PACKETSTORM",
        "id": "154812",
        "ident": null
      },
      {
        "date": "2020-08-04T14:26:33",
        "db": "PACKETSTORM",
        "id": "158750",
        "ident": null
      },
      {
        "date": "2020-12-16T18:19:59",
        "db": "PACKETSTORM",
        "id": "160568",
        "ident": null
      },
      {
        "date": "2019-10-11T15:02:56",
        "db": "PACKETSTORM",
        "id": "154810",
        "ident": null
      },
      {
        "date": "2019-03-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001806",
        "ident": null
      },
      {
        "date": "2019-02-20T16:29:00.837000",
        "db": "NVD",
        "id": "CVE-2019-8331",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2019-06-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-159766",
        "ident": null
      },
      {
        "date": "2019-03-07T00:00:00",
        "db": "BID",
        "id": "107375",
        "ident": null
      },
      {
        "date": "2022-02-16T03:20:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-001806",
        "ident": null
      },
      {
        "date": "2024-11-21T04:49:42.020000",
        "db": "NVD",
        "id": "CVE-2019-8331",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "107375"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "_id": null,
    "data": "Bootstrap\u00a0 Cross-site Scripting Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-001806"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "code execution, xss",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "170819"
      },
      {
        "db": "PACKETSTORM",
        "id": "154812"
      },
      {
        "db": "PACKETSTORM",
        "id": "158750"
      },
      {
        "db": "PACKETSTORM",
        "id": "154810"
      }
    ],
    "trust": 0.4
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0534",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.6.16"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "pivotal",
        "version": "3.6.6"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.3"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.6"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.12"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.19"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.7"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.11"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.15"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.17"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.15"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.18"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.12"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.5"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.4"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.1"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.7.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.4.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.6.18"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.5.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.5.x"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.6.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.7.15"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.6.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.6.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "3.4.1"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.7"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.12"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.4"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.3"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.2"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.1"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.5.20"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.5.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.4"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.7.15"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.18"
      },
      {
        "model": "rabbitmq",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6.9"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:rabbitmq",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GE Digital Security Team.",
    "sources": [
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-4966",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-4966",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "LOW",
            "trust": 1.9,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2017-4966",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-4966",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-4966",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-4966",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201705-1249",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-4966",
            "trust": 0.1,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. RabbitMQ management UI stores signed-in user credentials in a browser\u0027s local storage without expiration, making it possible to retrieve them using a chained attack. Pivotal RabbitMQ Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pivotal RabbitMQ Products are prone to  local information-disclosure vulnerability. \nAn attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks. ==========================================================================\nUbuntu Security Notice USN-6265-1\nJuly 31, 2023\n\nrabbitmq-server vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 16.04 LTS (Available with Ubuntu Pro)\n\nSummary:\n\nRabbitMQ could be made to expose sensitive information. \n\nSoftware Description:\n- rabbitmq-server: AMQP server written in Erlang\n\nDetails:\n\nIt was discovered that RabbitMQ incorrectly handled certain signed-in user\ncredentials. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 16.04 LTS (Available with Ubuntu Pro):\n  rabbitmq-server                 3.5.7-1ubuntu0.16.04.4+esm2\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n  https://ubuntu.com/security/notices/USN-6265-1\n  CVE-2017-4966\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "db": "PACKETSTORM",
        "id": "173857"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-4966",
        "trust": 2.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2432",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "98405",
        "trust": 0.4
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-4966",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "173857",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "PACKETSTORM",
        "id": "173857"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "id": "VAR-201706-0534",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.625
  },
  "last_update_date": "2025-04-20T22:29:14.391000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2017-4966: RabbitMQ local storage of credentials",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2017-4966"
      },
      {
        "title": "Pivotal RabbitMQ  and RabbitMQ for PCF Repair measures for information disclosure vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70584"
      },
      {
        "title": "Red Hat: CVE-2017-4966",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-4966"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2017-4965 CVE-2017-4966 CVE-2017-4967",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=6b6ae5ada791d0845be3b03f58e84470"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-4966"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a31bff03e9909229fd67996884614fdf"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-255",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "https://pivotal.io/security/cve-2017-4966"
      },
      {
        "trust": 1.6,
        "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-4966"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-4966"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2432"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.3,
        "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_9"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/200.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/98405"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-4966"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-6265-1"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "PACKETSTORM",
        "id": "173857"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "db": "PACKETSTORM",
        "id": "173857"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "date": "2017-05-04T00:00:00",
        "db": "BID",
        "id": "98405"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "date": "2023-08-01T16:34:49",
        "db": "PACKETSTORM",
        "id": "173857"
      },
      {
        "date": "2017-05-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "date": "2017-06-13T06:29:00.503000",
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-07-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-4966"
      },
      {
        "date": "2017-05-23T16:25:00",
        "db": "BID",
        "id": "98405"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      },
      {
        "date": "2022-03-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-4966"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "BID",
        "id": "98405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      }
    ],
    "trust": 0.9
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Pivotal RabbitMQ Vulnerabilities related to certificate and password management",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004862"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1249"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0526",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.19"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.7.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "pivotal",
        "version": "3.6.6"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.3"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.6"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.12"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.9"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.7"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.11"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.15"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.17"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.15"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.18"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.12"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.5"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.4"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.16"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.7.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.4.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.6.18"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.5.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.5.x"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.6.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.7.15"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.6.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.6.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.5.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.0"
      },
      {
        "model": "rabbitmq",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6.9"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "98406"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:rabbitmq",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The vendor reported this issue.",
    "sources": [
      {
        "db": "BID",
        "id": "98406"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-4967",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-4967",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-4967",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2017-4967",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-4967",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-4967",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201705-1247",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-4967",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks. Pivotal RabbitMQ Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "BID",
        "id": "98406"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-4967"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-4967",
        "trust": 2.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2432",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "98406",
        "trust": 0.4
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-4967",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "db": "BID",
        "id": "98406"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "id": "VAR-201706-0526",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.625
  },
  "last_update_date": "2025-04-20T22:24:06.087000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2017-4965 and CVE-2017-4967: XSS vulnerabilities in RabbitMQ management UI",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2017-4965"
      },
      {
        "title": "Pivotal RabbitMQ Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70582"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2017-4965 CVE-2017-4966 CVE-2017-4967",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=6b6ae5ada791d0845be3b03f58e84470"
      },
      {
        "title": "Red Hat: CVE-2017-4967",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-4967"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-4967"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a31bff03e9909229fd67996884614fdf"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://pivotal.io/security/cve-2017-4965"
      },
      {
        "trust": 1.6,
        "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-4967"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-4967"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2432"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.3,
        "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_9"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/79.html"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/98406"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863586"
      },
      {
        "trust": 0.1,
        "url": "https://security.archlinux.org/cve-2017-4967"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "db": "BID",
        "id": "98406"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "db": "BID",
        "id": "98406"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "date": "2017-05-11T00:00:00",
        "db": "BID",
        "id": "98406"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "date": "2017-05-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "date": "2017-06-13T06:29:00.520000",
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-07-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-4967"
      },
      {
        "date": "2017-05-23T16:25:00",
        "db": "BID",
        "id": "98406"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      },
      {
        "date": "2022-03-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-4967"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Pivotal RabbitMQ Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004863"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1247"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201706-0533",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "pivotal",
        "version": "3.6.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.19"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.6.15"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pivotal",
        "version": "1.5.3"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.3"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.6"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.12"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.9"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.7"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.11"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.5.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.17"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.4"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.10"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.15"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.14"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.18"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.5.12"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.5"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.5.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.4"
      },
      {
        "model": "rabbitmq server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.4.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.13"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.8"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.0"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.7.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.6.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.6.16"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.7.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.4.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.6.18"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.5.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.5.x"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.6.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pcf 1.7.15"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.6.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.6.9"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "3.4.3"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "3.6.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "3.4.1"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "3.4.2"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "3.4.0"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.7.7"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.7"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.12"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.4"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.3"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.2"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.1"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.5.20"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.5"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.4"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.7.15"
      },
      {
        "model": "rabbitmq for pcf",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "1.6.18"
      },
      {
        "model": "rabbitmq",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "3.6.9"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "98394"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:rabbitmq",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "GE Digital Security Team and by Brandon Williams from Early Warning.",
    "sources": [
      {
        "db": "BID",
        "id": "98394"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2017-4965",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-4965",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-4965",
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.1,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2017-4965",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "None",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-4965",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-4965",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201705-1213",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-4965",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks. Pivotal RabbitMQ Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Pivotal RabbitMQ products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "BID",
        "id": "98394"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-4965"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-4965",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "98394",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2432",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-4965",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "db": "BID",
        "id": "98394"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "id": "VAR-201706-0533",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.625
  },
  "last_update_date": "2025-04-20T20:10:58.079000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2017-4965 and CVE-2017-4967: XSS vulnerabilities in RabbitMQ management UI",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2017-4965"
      },
      {
        "title": "Pivotal RabbitMQ  and Pivotal RabbitMQ for PCF Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70557"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2017-4965 CVE-2017-4966 CVE-2017-4967",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=6b6ae5ada791d0845be3b03f58e84470"
      },
      {
        "title": "Red Hat: CVE-2017-4965",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-4965"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-4965"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a31bff03e9909229fd67996884614fdf"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "https://pivotal.io/security/cve-2017-4965"
      },
      {
        "trust": 1.8,
        "url": "http://www.securityfocus.com/bid/98394"
      },
      {
        "trust": 1.6,
        "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-4965"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-4965"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2432"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/79.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863586"
      },
      {
        "trust": 0.1,
        "url": "https://security.archlinux.org/cve-2017-4965"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "db": "BID",
        "id": "98394"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "db": "BID",
        "id": "98394"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-06-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "date": "2017-05-11T00:00:00",
        "db": "BID",
        "id": "98394"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "date": "2017-05-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "date": "2017-06-13T06:29:00.457000",
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-07-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-4965"
      },
      {
        "date": "2017-05-23T16:24:00",
        "db": "BID",
        "id": "98394"
      },
      {
        "date": "2017-07-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      },
      {
        "date": "2022-03-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-4965"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Pivotal RabbitMQ Vulnerable to cross-site scripting",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004861"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201705-1213"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201911-1657",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.16.7"
      },
      {
        "model": "rabbitmq",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.17.0"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.17.4"
      },
      {
        "model": "rabbitmq server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.8.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "rabbitmq server",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "broadcom",
        "version": "3.8.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "30"
      },
      {
        "model": "openstack",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "15"
      },
      {
        "model": "rabbitmq",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "1.16.0"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.7.21"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "31"
      },
      {
        "model": "rabbitmq",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "3.7.0"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.8.1"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.17.x"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "1.16.x"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.7.21"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pivotal platform 1.16.7"
      },
      {
        "model": "rabbitmq",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "for pivotal platform 1.17.4"
      },
      {
        "model": "rabbitmq",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "3.8"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:rabbitmq",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "155914"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2019-11287",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2019-11287",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2019-11287",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "security@pivotal.io",
            "availabilityImpact": "HIGH",
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 0.9,
            "id": "CVE-2019-11287",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-11287",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2019-11287",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "security@pivotal.io",
            "id": "CVE-2019-11287",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2019-11287",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201911-1307",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The \"X-Reason\" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing. Pivotal RabbitMQ and RabbitMQ for Pivotal Platform Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. ==========================================================================\nUbuntu Security Notice USN-5004-1\nJune 24, 2021\n\nrabbitmq-server vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 21.04\n- Ubuntu 20.10\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in rabbitmq-server. \n\nSoftware Description:\n- rabbitmq-server: AMQP server written in Erlang\n\nDetails:\n\nIt was discovered that RabbitMQ incorrectly handled certain inputs. \nAn attacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)\n\nJonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs. \nAn attacker could possibly use this issue to cause a denial of service. \n(CVE-2021-22116)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 21.04:\n  rabbitmq-server                 3.8.9-2ubuntu0.1\n\nUbuntu 20.10:\n  rabbitmq-server                 3.8.5-1ubuntu0.2\n\nUbuntu 20.04 LTS:\n  rabbitmq-server                 3.8.2-0ubuntu1.3\n\nUbuntu 18.04 LTS:\n  rabbitmq-server                 3.6.10-1ubuntu0.5\n\nUbuntu 16.04 ESM:\n  rabbitmq-server                 3.5.7-1ubuntu0.16.04.4+esm1\n\nIn general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: rabbitmq-server security update\nAdvisory ID:       RHSA-2020:0078-01\nProduct:           Red Hat Enterprise Linux OpenStack Platform\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:0078\nIssue date:        2020-01-13\nCVE Names:         CVE-2019-11287 \n=====================================================================\n\n1. Summary:\n\nAn update for rabbitmq-server is now available for Red Hat OpenStack\nPlatform 15 (Stein). \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat OpenStack Platform 15.0 - ppc64le, x86_64\n\n3. Description:\n\nRabbitMQ is an implementation of AMQP, the emerging standard for high\nperformance enterprise messaging. The RabbitMQ server is a robust and\nscalable implementation of an AMQP broker. \n\nSecurity Fix(es):\n\n* \"X-Reason\" HTTP Header can be leveraged to insert a malicious string\nleading to DoS (CVE-2019-11287)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat OpenStack Platform 15.0:\n\nSource:\nrabbitmq-server-3.7.22-1.el8ost.src.rpm\n\nppc64le:\nrabbitmq-server-3.7.22-1.el8ost.ppc64le.rpm\n\nx86_64:\nrabbitmq-server-3.7.22-1.el8ost.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-11287\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXhxCd9zjgjWX9erEAQhcJhAAkFi7Cpsx7AQav3E+LgCF0GblFmJWFP3L\nqg5F2/2FFdd1fFfHN3FvT9km571u1Hm9oPjKe4g2SgkrOmsP+mEsqD6nXHg1vHGw\nyOZ4GSGO0bde/Zj5USrmxFIwZcmbl5MzIrCqtx9fNPQPZzI4Hk8qmpINvc6wBZFs\naZafHly3mPvxP28rAnEtkjUCEzRuXnovQDrCW8sfNCT1Vhayg+A0cS2iM8rHak25\nSNlac9rq3dVkw1wWdgeVmNwu1bCcKopXLYrwVC70esX9fZxnCtPB0iTjy3g4qvxV\nxfcdsLLQOAYQZdBDtn1M+1GjjG7NLqcP6jD8ySBM+uNwyNiH20LpXmMO9ShysM31\nBrYG+aNJyb8AmrMtNF/MijJqv1SYakhHANK0OsdkgGokZWss7yhe7qOpZVU83z41\nowwpUrSsBO2xRb85nzo7AcoI0na/f965KyQjt7P1stMiTaXd84VucWlNcEH+I4ox\n0zbC4AWgKTbvnMNA2WDSPpx2fkcBS3PdjBi/1MqGES6srz+4oH8MunlqojqKjK9j\n/YkttwQD78cswQPm1LBaZNaFpqtFnFnAjN18E+phb2Y01hTCvwqVj05fp+eDNQM+\nN20HEjc8EDWAmyOGqripUnQ+rRBuPSfkU686szcZwrHFqrz/sh8h0qFRca/Za+4v\nqUGcuX2aS7Q=\n=/zG9\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "PACKETSTORM",
        "id": "163278"
      },
      {
        "db": "PACKETSTORM",
        "id": "155914"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-11287",
        "trust": 2.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "163278",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "155914",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0135",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2233",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2432",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "PACKETSTORM",
        "id": "163278"
      },
      {
        "db": "PACKETSTORM",
        "id": "155914"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "id": "VAR-201911-1657",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.625
  },
  "last_update_date": "2025-04-02T19:57:39.118000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2019-11287: RabbitMQ Web Management Plugin DoS via heap overflow",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2019-11287"
      },
      {
        "title": "Pivotal Software RabbitMQ Remediation of resource management error vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=104058"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-400",
        "trust": 1.8
      },
      {
        "problemtype": "CWE-134",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "https://access.redhat.com/errata/rhsa-2020:0078"
      },
      {
        "trust": 2.2,
        "url": "https://pivotal.io/security/cve-2019-11287"
      },
      {
        "trust": 1.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11287"
      },
      {
        "trust": 1.6,
        "url": "https://github.com/drunkenshells/disclosures/tree/master/cve-2019-11287-dos%20via%20heap%20overflow-rabbitmq%20web%20management%20plugin"
      },
      {
        "trust": 1.6,
        "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"
      },
      {
        "trust": 1.4,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11287"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/pytgr3d5fw2o25rxzotizmod2hauvbe4/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/eeq6o7pmnjkyfmqyhab55l423gyk63so/"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2019-11287"
      },
      {
        "trust": 0.6,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/pytgr3d5fw2o25rxzotizmod2hauvbe4/"
      },
      {
        "trust": 0.6,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/eeq6o7pmnjkyfmqyhab55l423gyk63so/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/163278/ubuntu-security-notice-usn-5004-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155914/red-hat-security-advisory-2020-0078-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2432"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2233"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0135/"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.6.10-1ubuntu0.5"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.9-2ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-5004-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.5-1ubuntu0.2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.2-0ubuntu1.3"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-22116"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "PACKETSTORM",
        "id": "163278"
      },
      {
        "db": "PACKETSTORM",
        "id": "155914"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "db": "PACKETSTORM",
        "id": "163278"
      },
      {
        "db": "PACKETSTORM",
        "id": "155914"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-12-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "date": "2021-06-24T17:57:46",
        "db": "PACKETSTORM",
        "id": "163278"
      },
      {
        "date": "2020-01-13T18:04:22",
        "db": "PACKETSTORM",
        "id": "155914"
      },
      {
        "date": "2019-11-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      },
      {
        "date": "2019-11-23T00:15:10.683000",
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-12-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      },
      {
        "date": "2021-08-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      },
      {
        "date": "2025-04-02T14:13:43.180000",
        "db": "NVD",
        "id": "CVE-2019-11287"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Pivotal RabbitMQ and  RabbitMQ for Pivotal Platform Vulnerable to resource exhaustion",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-012564"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "format string error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1307"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202001-1869",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "insurance calculation engine",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.1"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.20"
      },
      {
        "model": "communications element manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.4"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.0"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.1.0"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.0"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "communications brm - elastic charging engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3.0"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "financial services regulatory reporting with agilereporter",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.9.2.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.0"
      },
      {
        "model": "communications session route manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "communications session route manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.4"
      },
      {
        "model": "insurance calculation engine",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.2"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "communications session route manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.3"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.0"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.0"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.12"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2"
      },
      {
        "model": "retail point-of-service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3.0"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0"
      },
      {
        "model": "communications element manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.3"
      },
      {
        "model": "communications brm - elastic charging engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "communications element manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.1"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "spring framework",
        "scope": null,
        "trust": 0.8,
        "vendor": "pivotal",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Eric Zimanyi from Google",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2020-5397",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 4.9,
            "id": "CVE-2020-5397",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 1.8,
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 4.9,
            "id": "VHN-183522",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 0.1,
            "vectorString": "AV:N/AC:H/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "security@pivotal.io",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-5397",
            "impactScore": 1.4,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-5397",
            "impactScore": 1.4,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-5397",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "security@pivotal.io",
            "id": "CVE-2020-5397",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2020-5397",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202001-841",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-183522",
            "trust": 0.1,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack. Spring Framework Contains a cross-site request forgery vulnerability.Information may be altered. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could exploit this vulnerability to send unexpected requests to the server through an affected client",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-5397",
        "trust": 2.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841",
        "trust": 0.7
      },
      {
        "db": "NSFOCUS",
        "id": "48040",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-183522",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "id": "VAR-202001-1869",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T23:11:34.722000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2020-5397: CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2020-5397"
      },
      {
        "title": "Pivotal Software Spring Framework Fixes for cross-site request forgery vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=107142"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-352",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://pivotal.io/security/cve-2020-5397"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5397"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5397"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/48040"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/spring-framework-cross-site-request-forgery-via-cors-preflight-requests-31363"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-01-17T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "date": "2020-02-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "date": "2020-01-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      },
      {
        "date": "2020-01-17T19:15:14.727000",
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-25T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183522"
      },
      {
        "date": "2020-02-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      },
      {
        "date": "2022-07-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      },
      {
        "date": "2024-11-21T05:34:03.850000",
        "db": "NVD",
        "id": "CVE-2020-5397"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Vulnerable to cross-site request forgery",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001404"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "cross-site request forgery",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-841"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201804-1676",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "retail point-of-sale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.4"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.6.0"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.1.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.2"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.1.0.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.2"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.0"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.3.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "tape library acsls",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.4"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.1"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.5"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.2"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.3"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.0.1"
      },
      {
        "model": "retail point-of-sale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "fuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "1.0.0"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.2"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.16"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.3"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.2.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.2"
      },
      {
        "model": "communications converged application server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0.0.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.1"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.3"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.0.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0.3"
      },
      {
        "model": "health sciences information manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3.15"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.1"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.9"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.14"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.15"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103696"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Alvaro Munoz (@pwntester) Micro Focus Fortify.",
    "sources": [
      {
        "db": "BID",
        "id": "103696"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-1270",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2018-1270",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-122685",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2018-1270",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-1270",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-1270",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-1270",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201804-245",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122685",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-1270",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. Spring Framework Contains a security check vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pivotal Spring Framework is prone to remote code-execution vulnerability. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Pivotal Spring Framework is an open source Java and Java EE application framework developed by Pivotal Software in the United States. The framework helps developers build high-quality applications. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Critical: Red Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update\nAdvisory ID:       RHSA-2018:2939-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:2939\nIssue date:        2018-10-17\nCVE Names:         CVE-2017-12617 CVE-2018-1260 CVE-2018-1270\n                   CVE-2018-1271 CVE-2018-1275 CVE-2018-1304\n                   CVE-2018-1305 CVE-2018-1336 CVE-2018-7489\n====================================================================\n1. Summary:\n\nAn update is now available for Red Hat Fuse Integration Services. \n\nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Fuse Integration Services provides a set of tools and containerized\nxPaaS images that enable development, deployment, and management of\nintegration microservices within OpenShift. \n\nSecurity fix(es):\n\n* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe\nserialization via c3p0 libraries (CVE-2018-7489)\n\n* spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275)\n\n* spring-framework: Directory traversal vulnerability with static resources\non Windows filesystems (CVE-2018-1271)\n\n* spring-framework: Possible RCE via spring messaging (CVE-2018-1270)\n\n* spring-security-oauth: remote code execution in the authorization process\n(CVE-2018-1260)\n\n* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)\n\n* tomcat: Incorrect handling of empty string URL in security constraints\ncan lead to unintended exposure of resources (CVE-2018-1304)\n\n* tomcat: Late application of security constraints can lead to resource\nexposure for unauthorised users (CVE-2018-1305)\n\n* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nUpdating instructions and release notes may be found at:\n\nhttps://access.redhat.com/articles/3060411\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615\n1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users\n1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources\n1549276 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries\n1564405 - CVE-2018-1270 spring-framework: Possible RCE via spring messaging\n1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270\n1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems\n1584376 - CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process\n1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-12617\nhttps://access.redhat.com/security/cve/CVE-2018-1260\nhttps://access.redhat.com/security/cve/CVE-2018-1270\nhttps://access.redhat.com/security/cve/CVE-2018-1271\nhttps://access.redhat.com/security/cve/CVE-2018-1275\nhttps://access.redhat.com/security/cve/CVE-2018-1304\nhttps://access.redhat.com/security/cve/CVE-2018-1305\nhttps://access.redhat.com/security/cve/CVE-2018-1336\nhttps://access.redhat.com/security/cve/CVE-2018-7489\nhttps://access.redhat.com/security/updates/classification/#critical\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBW8eNhdzjgjWX9erEAQgCYw//fxaqJeQ2VPWVSwfYTALj1Lvjrx0bTnip\nT8MKlgYC4PSKZcOmchvC3f01kNljr1CEJaUQWQi1A+is141gjHgV2nFMSGTUBwBK\nyGSPLD0oLDJWc/7y7qWMxrotEWjROKIQ72AXwjOtcEeSe9vzSmWotexKR0JYUdgw\n8GAMlBhyiQagOncOP3JkWnUkTdNryhY9f5tfX7xfXcDDoxjq4rAVqLrCrWZvr4ec\nP89vACj8PonE+U5DvFrWWH9nKxGcdvnm0ouib/XFB8GJ/jHhRgBsk/CFpDoEEng5\nrzFmbt7fm1OKfgFhRCyrxsVQVUbk0d1ATs+Lpu7Ty3fGysW2bN860Hi+20RSWyow\nybjLNU9xSHUG9623XTyyVYgRIox991zpHCHsDWwjsV1NxfjdYlJfHGtuHKNeVQzf\nh71cHuC7o7VhxZFhMFHjp+O71Ow5N6HcrZAtmKrihfhHRVFugXkvFGRl55gqb4rr\nY6/dX/H1abVCNGA5kziXQnO0ce/dAdUZ2mb8XRs3UVgt0MIVD1zisE9d52fsRkr/\nNygTi1xn4Pmodoth3C209aA4Iaycixmx4F8HoXSTPNUCYrr0FIjBpDJX35TeTcxg\n/RU/vyHwdAwz/5aJgFDFxILd4z8a9bIpYGMglMU1rB5y/ovuBB4qUU/o4y8aVYzh\nbunfRFjDlIY=l0NF\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "BID",
        "id": "103696"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-1270",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "103696",
        "trust": 2.0
      },
      {
        "db": "EXPLOIT-DB",
        "id": "44796",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0544",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.1395",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "147974",
        "trust": 0.1
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-97214",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-122685",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1270",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "149847",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "db": "BID",
        "id": "103696"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "id": "VAR-201804-1676",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:30:55.535000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-1270: Remote Code Execution with spring-messaging",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2018-1270"
      },
      {
        "title": "Pivotal Spring Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83088"
      },
      {
        "title": "Red Hat: Critical: Red Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182939 - Security Advisory"
      },
      {
        "title": "Debian CVElist Bug Report Logs: libspring-java: CVE-2018-1270 CVE-2018-1272",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=cf592ea3b0a1913a29c923afe44cd4b7"
      },
      {
        "title": "Red Hat: CVE-2018-1270",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2018-1270"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=81c63752a6f26433af2128b2e8c02385"
      },
      {
        "title": "IBM: Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3dea47d76eee003a50f853f241578c37"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=55ea315dfb69fce8383762ac64250315"
      },
      {
        "title": "CVE-2018-1270",
        "trust": 0.1,
        "url": "https://github.com/Venscor/CVE-2018-1270 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-358",
        "trust": 1.9
      },
      {
        "problemtype": "CWE-94",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "http://www.securityfocus.com/bid/103696"
      },
      {
        "trust": 2.0,
        "url": "https://pivotal.io/security/cve-2018-1270"
      },
      {
        "trust": 1.8,
        "url": "https://access.redhat.com/errata/rhsa-2018:2939"
      },
      {
        "trust": 1.7,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.exploit-db.com/exploits/44796/"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3cissues.geode.apache.org%3e"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1270"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1270"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3cissues.geode.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "http://www.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75922"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.1395"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-guardium-data-encryption-gde-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/cve/cve-2018-1270"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1564405"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1271"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-12617"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12617"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-7489"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1305"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-7489"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1304"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1271"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1304"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1275"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/3060411"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1275"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1305"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "db": "BID",
        "id": "103696"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "db": "BID",
        "id": "103696"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-04-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "date": "2018-04-06T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "BID",
        "id": "103696"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "date": "2018-10-18T03:51:21",
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "date": "2018-04-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "date": "2018-04-06T13:29:00.453000",
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-08-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122685"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1270"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "BID",
        "id": "103696"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      },
      {
        "date": "2021-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      },
      {
        "date": "2024-11-21T03:59:30.477000",
        "db": "NVD",
        "id": "CVE-2018-1270"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Vulnerabilities related to security checks",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003097"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-245"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201804-1674",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "retail point-of-sale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.4"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.15"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.6.0"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.1.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.2"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.1.0.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.2"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.3.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "tape library acsls",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.4"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.1"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.5"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.2"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.3"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.0.1"
      },
      {
        "model": "retail point-of-sale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.2"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.3"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.2.1"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.2"
      },
      {
        "model": "communications converged application server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0.0.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.3"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.0.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0.3"
      },
      {
        "model": "health sciences information manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3.15"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.1"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.9"
      },
      {
        "model": "jboss fuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "jboss fuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "jboss a-mq",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.14"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.15"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103697"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Philippe Arteau from GoSecure.",
    "sources": [
      {
        "db": "BID",
        "id": "103697"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-1272",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "CVE-2018-1272",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "VHN-122707",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.6,
            "id": "CVE-2018-1272",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-1272",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-1272",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-1272",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201804-243",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122707",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-1272",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles. Spring Framework Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pivotal Spring Framework is prone to a remote privilege-escalation vulnerability. \nAn attacker can exploit this issue to gain elevated privileges. Failed exploit attempts will likely result in denial-of-service conditions. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: Fuse 7.1 security update\nAdvisory ID:       RHSA-2018:2669-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:2669\nIssue date:        2018-09-11\nCross references:  RHBA-2018:2665-04\nCVE Names:         CVE-2014-0114 CVE-2016-5397 CVE-2016-1000338\n                   CVE-2016-1000339 CVE-2016-1000340 CVE-2016-1000341\n                   CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000344\n                   CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000352\n                   CVE-2017-14063 CVE-2018-1114 CVE-2018-1271\n                   CVE-2018-1272 CVE-2018-1338 CVE-2018-1339\n                   CVE-2018-8036 CVE-2018-8088 CVE-2018-1000129\n                   CVE-2018-1000130 CVE-2018-1000180\n====================================================================\n1. Summary:\n\nAn update is now available for Red Hat Fuse. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Fuse, based on Apache ServiceMix, provides a small-footprint,\nflexible, open source enterprise service bus and integration platform. \n\nThis release of Red Hat Fuse 7.1 serves as a replacement for Red Hat Fuse\n7.0, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* Apache Struts 1: Class Loader manipulation via request parameters\n(CVE-2014-0114)\n\n* thrift: Improper file path sanitization in\nt_go_generator.cc:format_go_output() of the go client library can allow an\nattacker to inject commands (CVE-2016-5397)\n\n* slf4j: Deserialisation vulnerability in EventData constructor can allow\nfor arbitrary code execution (CVE-2018-8088)\n\n* jolokia: JMX proxy mode vulnerable to remote code execution\n(CVE-2018-1000130)\n\n* bouncycastle: DSA does not fully validate ASN.1 encoding during signature\nverification allowing for injection of unsigned data (CVE-2016-1000338)\n\n* bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339)\n\n* bouncycastle: Information exposure in DSA signature generation via timing\nattack (CVE-2016-1000341)\n\n* bouncycastle: ECDSA improper validation of ASN.1 encoding of signature\n(CVE-2016-1000342)\n\n* bouncycastle: DHIES implementation allowed the use of ECB mode\n(CVE-2016-1000344)\n\n* bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle\nattack (CVE-2016-1000345)\n\n* bouncycastle: Other party DH public keys are not fully validated\n(CVE-2016-1000346)\n\n* bouncycastle: ECIES implementation allowed the use of ECB mode\n(CVE-2016-1000352)\n\n* async-http-client: Invalid URL parsing with \u0027?\u0027 (CVE-2017-14063)\n\n* undertow: File descriptor leak caused by\nJarURLConnection.getLastModified() allows attacker to cause a denial of\nservice (CVE-2018-1114)\n\n* spring-framework: Directory traversal vulnerability with static resources\non Windows filesystems (CVE-2018-1271)\n\n* tika: Infinite loop in BPGParser can allow remote attacker to cause a\ndenial of service (CVE-2018-1338)\n\n* tika: Infinite loop in ChmParser can allow remote attacker to cause a\ndenial of service (CVE-2018-1339)\n\n* pdfbox: Infinite loop in AFMParser.java allows for out of memory erros\nvia crafted PDF (CVE-2018-8036)\n\n* jolokia: Cross site scripting in the HTTP servlet (CVE-2018-1000129)\n\n* bouncycastle: flaw in the low-level interface to RSA key pair generator\n(CVE-2018-1000180)\n\n* bouncycastle: Carry propagation bug in math.raw.Nat??? class\n(CVE-2016-1000340)\n\n* bouncycastle: DSA key pair generator generates a weak private key by\ndefault (CVE-2016-1000343)\n\n* spring-framework: Multipart content pollution (CVE-2018-1272)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\nRed Hat would like to thank Chris McCown for reporting CVE-2018-8088. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are located in the download section of the\ncustomer portal. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1091938 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters\n1487563 - CVE-2017-14063 async-http-client: Invalid URL parsing with \u0027?\u0027\n1544620 - CVE-2016-5397 thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands\n1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution\n1559316 - CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution\n1559317 - CVE-2018-1000129 jolokia: Cross site scripting in the HTTP servlet\n1564408 - CVE-2018-1272 spring-framework: Multipart content pollution\n1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems\n1572421 - CVE-2018-1338 tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service\n1572424 - CVE-2018-1339 tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service\n1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service\n1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator\n1588313 - CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data\n1588314 - CVE-2016-1000344 bouncycastle: DHIES implementation allowed the use of ECB mode\n1588323 - CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack\n1588327 - CVE-2016-1000346 bouncycastle: Other party DH public keys are not fully validated\n1588330 - CVE-2016-1000352 bouncycastle: ECIES implementation allowed the use of ECB mode\n1588688 - CVE-2016-1000340 bouncycastle: Carry propagation bug in math.raw.Nat??? class\n1588695 - CVE-2016-1000339 bouncycastle: Information leak in AESFastEngine class\n1588708 - CVE-2016-1000341 bouncycastle: Information exposure in DSA signature generation via timing attack\n1588715 - CVE-2016-1000342 bouncycastle: ECDSA improper validation of ASN.1 encoding of signature\n1588721 - CVE-2016-1000343 bouncycastle: DSA key pair generator generates a weak private key by default\n1597490 - CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2014-0114\nhttps://access.redhat.com/security/cve/CVE-2016-5397\nhttps://access.redhat.com/security/cve/CVE-2016-1000338\nhttps://access.redhat.com/security/cve/CVE-2016-1000339\nhttps://access.redhat.com/security/cve/CVE-2016-1000340\nhttps://access.redhat.com/security/cve/CVE-2016-1000341\nhttps://access.redhat.com/security/cve/CVE-2016-1000342\nhttps://access.redhat.com/security/cve/CVE-2016-1000343\nhttps://access.redhat.com/security/cve/CVE-2016-1000344\nhttps://access.redhat.com/security/cve/CVE-2016-1000345\nhttps://access.redhat.com/security/cve/CVE-2016-1000346\nhttps://access.redhat.com/security/cve/CVE-2016-1000352\nhttps://access.redhat.com/security/cve/CVE-2017-14063\nhttps://access.redhat.com/security/cve/CVE-2018-1114\nhttps://access.redhat.com/security/cve/CVE-2018-1271\nhttps://access.redhat.com/security/cve/CVE-2018-1272\nhttps://access.redhat.com/security/cve/CVE-2018-1338\nhttps://access.redhat.com/security/cve/CVE-2018-1339\nhttps://access.redhat.com/security/cve/CVE-2018-8036\nhttps://access.redhat.com/security/cve/CVE-2018-8088\nhttps://access.redhat.com/security/cve/CVE-2018-1000129\nhttps://access.redhat.com/security/cve/CVE-2018-1000130\nhttps://access.redhat.com/security/cve/CVE-2018-1000180\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=7.1.0\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/\nhttps://access.redhat.com/articles/2939351\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBW5d0pdzjgjWX9erEAQg6Yw//dFPzbxBQz8m4jwPwRjNmTDM/tTOnxZSt\nMTqjRp8zX80qhQVMlVj7d9TQLX25bR9Vx4//Kktu3EIsON+ddxy+LZQBlX7l4XMy\nSP8FGfSp+GV6jiS+aOoRw+NaE8omM8AwYi0Clv562FIcM8qiqGt+O/QK0peN5JYA\nCOa/6uSPsNftk7Sq3aQ0jWV35L92r2S1FeIg6FGanyqLO1Y+sKePY5T5HRSNpp06\nlh00QeAdYlcGrIBbsQnds4uHW5PPrS7HoafCEuIPdCDoCjZTms3i9K3f57ZQ6ojn\nmpKaQgiWVPGenzAIh+JzFaMWTdMwVt6nDPuSt9SC6uDC20c+ffBjjsC2w0Bh/bVr\nyxas3NTobxggV8lN0PF0MHx776QtRyc+XukUZ+7FPm6irhfqMVBkUrD95s/qjNNF\nKNm8Nsz+HFqwaP0XCkfiBTPZs5yWf83KA/Qw9MOoJGVLXF28wzrELxPl8eMizCtX\nMCfop2FzGCCMkanRHMzZ+RkFQ9+wN+WHw1UXiANEaM+55yGfIWhqYOH2zQZzByNY\nYdKlSrAw2jvODvawFclMYG+zD97pr1VMvLb8W8uUiqRwKnsu303EtTk+IyTCcoS9\nKDczeRZr/X98Ww0gXOEnUcVsTby6fhbtIgUbPt/3obsV6joyaHf5/mHj49uPluva\nTLag+xVs1p4=vq4F\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. For further\ninformation, refer to the Release Notes linked to in the References\nsection. \n\nSecurity Fix(es):\n\n* spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275)\n\n* spring-framework: Directory traversal vulnerability with static resources\non Windows filesystems (CVE-2018-1271)\n\n* tomcat: Incorrect handling of empty string URL in security constraints\ncan lead to unintended exposure of resources (CVE-2018-1304)\n\n* tomcat: Late application of security constraints can lead to resource\nexposure for unauthorised users (CVE-2018-1305)\n\n* spring-framework: Multipart content pollution (CVE-2018-1272)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users\n1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources\n1564408 - CVE-2018-1272 spring-framework: Multipart content pollution\n1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270\n1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems\n\n5",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "BID",
        "id": "103697"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-1272",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "103697",
        "trust": 2.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0544",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-122707",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1272",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "149311",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "147489",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "db": "BID",
        "id": "103697"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "id": "VAR-201804-1674",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:25:46.875000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-1272: Multipart Content Pollution with Spring Framework",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2018-1272"
      },
      {
        "title": "Pivotal Spring Framework Fixes for permission permissions and access control vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83086"
      },
      {
        "title": "Debian CVElist Bug Report Logs: libspring-java: CVE-2018-1270 CVE-2018-1272",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=cf592ea3b0a1913a29c923afe44cd4b7"
      },
      {
        "title": "Red Hat: CVE-2018-1272",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2018-1272"
      },
      {
        "title": "Red Hat: Important: Fuse 7.1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182669 - Security Advisory"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=81c63752a6f26433af2128b2e8c02385"
      },
      {
        "title": "IBM: Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3dea47d76eee003a50f853f241578c37"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=55ea315dfb69fce8383762ac64250315"
      },
      {
        "title": "gocarts",
        "trust": 0.1,
        "url": "https://github.com/tomoyamachi/gocarts "
      },
      {
        "title": "cybsec",
        "trust": 0.1,
        "url": "https://github.com/ilmari666/cybsec "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-264",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/103697"
      },
      {
        "trust": 2.1,
        "url": "https://pivotal.io/security/cve-2018-1272"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:1320"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:2669"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.0,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1272"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1272"
      },
      {
        "trust": 0.6,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/141286"
      },
      {
        "trust": 0.6,
        "url": "http://www.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75922"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-identified-in-ibm-storediq/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-guardium-data-encryption-gde-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2018-1272"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1564408"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1271"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1271"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=57444"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/tomoyamachi/gocarts"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000129"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2014-0114"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000342"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000352"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000346"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1114"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5397"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14063"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000343"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-14063"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000130"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000342"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000352"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000346"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000339"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000340"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000341"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000341"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8088"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000343"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8036"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000344"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000345"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=jboss.fuse\u0026downloadtype=distributions\u0026version=7.1.0"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000340"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000129"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1339"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000180"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1339"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/2939351"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000339"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000130"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8036"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000180"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8088"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5397"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000344"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000345"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1304"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html/red_hat_openshift_application_runtimes_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1304"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1275"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=catrhoar.spring.boot\u0026version=1.5.12"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1275"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1305"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1305"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "db": "BID",
        "id": "103697"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "db": "BID",
        "id": "103697"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-04-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "date": "2018-04-06T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "BID",
        "id": "103697"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "date": "2018-09-11T15:41:48",
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "date": "2018-05-04T01:11:44",
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "date": "2018-04-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "date": "2018-04-06T13:29:00.563000",
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122707"
      },
      {
        "date": "2022-06-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1272"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "BID",
        "id": "103697"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      },
      {
        "date": "2021-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      },
      {
        "date": "2024-11-21T03:59:30.877000",
        "db": "NVD",
        "id": "CVE-2018-1272"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Vulnerabilities related to authorization, permissions, and access control",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003099"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control issues",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-243"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201804-1675",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "retail point-of-sale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.4"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.15"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.6.0"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.1.1"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.1.0.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.2"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.0"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.3.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "tape library acsls",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.4"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.1"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.5"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.2"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.3"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.0.1"
      },
      {
        "model": "retail point-of-sale",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.2"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "insurance calculation engine",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.3"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.2.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.2"
      },
      {
        "model": "communications converged application server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0.0.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.1"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.3"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.0.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0.3"
      },
      {
        "model": "health sciences information manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.2"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3.15"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.1"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.9"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.14"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.15"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Orange Tsai (@orange_8361) from DEVCORE.",
    "sources": [
      {
        "db": "BID",
        "id": "103699"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-1271",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-1271",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-122696",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "id": "CVE-2018-1271",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.9,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-1271",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-1271",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-1271",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201804-244",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122696",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-1271",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. Spring Framework Contains a path traversal vulnerability.Information may be obtained. Pivotal Spring Framework is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. \nA remote attacker could exploit this issue using directory-traversal  characters (\u0027../\u0027) to access arbitrary files that contain sensitive  information. Information harvested may aid in launching further attacks. ### Affected Pivotal Products and Versions * Severity is high unless otherwise noted. Note also that this attack does not apply to applications that: Do not... -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: Fuse 7.1 security update\nAdvisory ID:       RHSA-2018:2669-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:2669\nIssue date:        2018-09-11\nCross references:  RHBA-2018:2665-04\nCVE Names:         CVE-2014-0114 CVE-2016-5397 CVE-2016-1000338\n                   CVE-2016-1000339 CVE-2016-1000340 CVE-2016-1000341\n                   CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000344\n                   CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000352\n                   CVE-2017-14063 CVE-2018-1114 CVE-2018-1271\n                   CVE-2018-1272 CVE-2018-1338 CVE-2018-1339\n                   CVE-2018-8036 CVE-2018-8088 CVE-2018-1000129\n                   CVE-2018-1000130 CVE-2018-1000180\n====================================================================\n1. Summary:\n\nAn update is now available for Red Hat Fuse. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Fuse, based on Apache ServiceMix, provides a small-footprint,\nflexible, open source enterprise service bus and integration platform. \n\nThis release of Red Hat Fuse 7.1 serves as a replacement for Red Hat Fuse\n7.0, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* Apache Struts 1: Class Loader manipulation via request parameters\n(CVE-2014-0114)\n\n* thrift: Improper file path sanitization in\nt_go_generator.cc:format_go_output() of the go client library can allow an\nattacker to inject commands (CVE-2016-5397)\n\n* slf4j: Deserialisation vulnerability in EventData constructor can allow\nfor arbitrary code execution (CVE-2018-8088)\n\n* jolokia: JMX proxy mode vulnerable to remote code execution\n(CVE-2018-1000130)\n\n* bouncycastle: DSA does not fully validate ASN.1 encoding during signature\nverification allowing for injection of unsigned data (CVE-2016-1000338)\n\n* bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339)\n\n* bouncycastle: Information exposure in DSA signature generation via timing\nattack (CVE-2016-1000341)\n\n* bouncycastle: ECDSA improper validation of ASN.1 encoding of signature\n(CVE-2016-1000342)\n\n* bouncycastle: DHIES implementation allowed the use of ECB mode\n(CVE-2016-1000344)\n\n* bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle\nattack (CVE-2016-1000345)\n\n* bouncycastle: Other party DH public keys are not fully validated\n(CVE-2016-1000346)\n\n* bouncycastle: ECIES implementation allowed the use of ECB mode\n(CVE-2016-1000352)\n\n* async-http-client: Invalid URL parsing with \u0027?\u0027 (CVE-2017-14063)\n\n* undertow: File descriptor leak caused by\nJarURLConnection.getLastModified() allows attacker to cause a denial of\nservice (CVE-2018-1114)\n\n* spring-framework: Directory traversal vulnerability with static resources\non Windows filesystems (CVE-2018-1271)\n\n* tika: Infinite loop in BPGParser can allow remote attacker to cause a\ndenial of service (CVE-2018-1338)\n\n* tika: Infinite loop in ChmParser can allow remote attacker to cause a\ndenial of service (CVE-2018-1339)\n\n* pdfbox: Infinite loop in AFMParser.java allows for out of memory erros\nvia crafted PDF (CVE-2018-8036)\n\n* jolokia: Cross site scripting in the HTTP servlet (CVE-2018-1000129)\n\n* bouncycastle: flaw in the low-level interface to RSA key pair generator\n(CVE-2018-1000180)\n\n* bouncycastle: Carry propagation bug in math.raw.Nat??? class\n(CVE-2016-1000340)\n\n* bouncycastle: DSA key pair generator generates a weak private key by\ndefault (CVE-2016-1000343)\n\n* spring-framework: Multipart content pollution (CVE-2018-1272)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\nRed Hat would like to thank Chris McCown for reporting CVE-2018-8088. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are located in the download section of the\ncustomer portal. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1091938 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters\n1487563 - CVE-2017-14063 async-http-client: Invalid URL parsing with \u0027?\u0027\n1544620 - CVE-2016-5397 thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands\n1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution\n1559316 - CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution\n1559317 - CVE-2018-1000129 jolokia: Cross site scripting in the HTTP servlet\n1564408 - CVE-2018-1272 spring-framework: Multipart content pollution\n1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems\n1572421 - CVE-2018-1338 tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service\n1572424 - CVE-2018-1339 tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service\n1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service\n1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator\n1588313 - CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data\n1588314 - CVE-2016-1000344 bouncycastle: DHIES implementation allowed the use of ECB mode\n1588323 - CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack\n1588327 - CVE-2016-1000346 bouncycastle: Other party DH public keys are not fully validated\n1588330 - CVE-2016-1000352 bouncycastle: ECIES implementation allowed the use of ECB mode\n1588688 - CVE-2016-1000340 bouncycastle: Carry propagation bug in math.raw.Nat??? class\n1588695 - CVE-2016-1000339 bouncycastle: Information leak in AESFastEngine class\n1588708 - CVE-2016-1000341 bouncycastle: Information exposure in DSA signature generation via timing attack\n1588715 - CVE-2016-1000342 bouncycastle: ECDSA improper validation of ASN.1 encoding of signature\n1588721 - CVE-2016-1000343 bouncycastle: DSA key pair generator generates a weak private key by default\n1597490 - CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2014-0114\nhttps://access.redhat.com/security/cve/CVE-2016-5397\nhttps://access.redhat.com/security/cve/CVE-2016-1000338\nhttps://access.redhat.com/security/cve/CVE-2016-1000339\nhttps://access.redhat.com/security/cve/CVE-2016-1000340\nhttps://access.redhat.com/security/cve/CVE-2016-1000341\nhttps://access.redhat.com/security/cve/CVE-2016-1000342\nhttps://access.redhat.com/security/cve/CVE-2016-1000343\nhttps://access.redhat.com/security/cve/CVE-2016-1000344\nhttps://access.redhat.com/security/cve/CVE-2016-1000345\nhttps://access.redhat.com/security/cve/CVE-2016-1000346\nhttps://access.redhat.com/security/cve/CVE-2016-1000352\nhttps://access.redhat.com/security/cve/CVE-2017-14063\nhttps://access.redhat.com/security/cve/CVE-2018-1114\nhttps://access.redhat.com/security/cve/CVE-2018-1271\nhttps://access.redhat.com/security/cve/CVE-2018-1272\nhttps://access.redhat.com/security/cve/CVE-2018-1338\nhttps://access.redhat.com/security/cve/CVE-2018-1339\nhttps://access.redhat.com/security/cve/CVE-2018-8036\nhttps://access.redhat.com/security/cve/CVE-2018-8088\nhttps://access.redhat.com/security/cve/CVE-2018-1000129\nhttps://access.redhat.com/security/cve/CVE-2018-1000130\nhttps://access.redhat.com/security/cve/CVE-2018-1000180\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=7.1.0\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/\nhttps://access.redhat.com/articles/2939351\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBW5d0pdzjgjWX9erEAQg6Yw//dFPzbxBQz8m4jwPwRjNmTDM/tTOnxZSt\nMTqjRp8zX80qhQVMlVj7d9TQLX25bR9Vx4//Kktu3EIsON+ddxy+LZQBlX7l4XMy\nSP8FGfSp+GV6jiS+aOoRw+NaE8omM8AwYi0Clv562FIcM8qiqGt+O/QK0peN5JYA\nCOa/6uSPsNftk7Sq3aQ0jWV35L92r2S1FeIg6FGanyqLO1Y+sKePY5T5HRSNpp06\nlh00QeAdYlcGrIBbsQnds4uHW5PPrS7HoafCEuIPdCDoCjZTms3i9K3f57ZQ6ojn\nmpKaQgiWVPGenzAIh+JzFaMWTdMwVt6nDPuSt9SC6uDC20c+ffBjjsC2w0Bh/bVr\nyxas3NTobxggV8lN0PF0MHx776QtRyc+XukUZ+7FPm6irhfqMVBkUrD95s/qjNNF\nKNm8Nsz+HFqwaP0XCkfiBTPZs5yWf83KA/Qw9MOoJGVLXF28wzrELxPl8eMizCtX\nMCfop2FzGCCMkanRHMzZ+RkFQ9+wN+WHw1UXiANEaM+55yGfIWhqYOH2zQZzByNY\nYdKlSrAw2jvODvawFclMYG+zD97pr1VMvLb8W8uUiqRwKnsu303EtTk+IyTCcoS9\nKDczeRZr/X98Ww0gXOEnUcVsTby6fhbtIgUbPt/3obsV6joyaHf5/mHj49uPluva\nTLag+xVs1p4=vq4F\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. For further\ninformation, refer to the Release Notes linked to in the References\nsection. \n\nSecurity Fix(es):\n\n* spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275)\n\n* spring-framework: Directory traversal vulnerability with static resources\non Windows filesystems (CVE-2018-1271)\n\n* tomcat: Incorrect handling of empty string URL in security constraints\ncan lead to unintended exposure of resources (CVE-2018-1304)\n\n* tomcat: Late application of security constraints can lead to resource\nexposure for unauthorised users (CVE-2018-1305)\n\n* spring-framework: Multipart content pollution (CVE-2018-1272)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users\n1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources\n1564408 - CVE-2018-1272 spring-framework: Multipart content pollution\n1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270\n1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems\n\n5",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "BID",
        "id": "103699"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      }
    ],
    "trust": 2.34
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-122696",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-1271",
        "trust": 3.2
      },
      {
        "db": "BID",
        "id": "103699",
        "trust": 2.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0544",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "147489",
        "trust": 0.2
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-97483",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-122696",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1271",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "149311",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "149847",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "db": "BID",
        "id": "103699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "id": "VAR-201804-1675",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:21:51.372000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-1271: Directory Traversal with Spring MVC on Windows",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2018-1271"
      },
      {
        "title": "Pivotal Spring Framework Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83087"
      },
      {
        "title": "Red Hat: Critical: Red Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182939 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: Fuse 7.1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182669 - Security Advisory"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=81c63752a6f26433af2128b2e8c02385"
      },
      {
        "title": "IBM: Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3dea47d76eee003a50f853f241578c37"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=55ea315dfb69fce8383762ac64250315"
      },
      {
        "title": "Vulnerability_Environment",
        "trust": 0.1,
        "url": "https://github.com/x-f1v3/Vulnerability_Environment "
      },
      {
        "title": "Poc-Exp",
        "trust": 0.1,
        "url": "https://github.com/0wlsec/Poc-Exp "
      },
      {
        "title": "Poc-Exp",
        "trust": 0.1,
        "url": "https://github.com/pen4uin/Poc-Exp "
      },
      {
        "title": "gocarts",
        "trust": 0.1,
        "url": "https://github.com/tomoyamachi/gocarts "
      },
      {
        "title": "nuclei-templates",
        "trust": 0.1,
        "url": "https://github.com/projectdiscovery/nuclei-templates "
      },
      {
        "title": "cybsec",
        "trust": 0.1,
        "url": "https://github.com/ilmari666/cybsec "
      },
      {
        "title": "pt",
        "trust": 0.1,
        "url": "https://github.com/superfish9/pt "
      },
      {
        "title": "vulnerability-lab",
        "trust": 0.1,
        "url": "https://github.com/pen4uin/vulnerability-lab "
      },
      {
        "title": "Vulnerability_Research",
        "trust": 0.1,
        "url": "https://github.com/pen4uin/Vulnerability_Research "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/merlinepedra25/nuclei-templates "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/pen4uin/awesome-vulnerability-research "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/merlinepedra/nuclei-templates "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/pen4uin/vulnerability-research-list "
      },
      {
        "title": "nuclei-templates",
        "trust": 0.1,
        "url": "https://github.com/storenth/nuclei-templates "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/pen4uin/vulnerability-research "
      },
      {
        "title": "kenzer-templates",
        "trust": 0.1,
        "url": "https://github.com/Elsfa7-110/kenzer-templates "
      },
      {
        "title": "kenzer-templates",
        "trust": 0.1,
        "url": "https://github.com/ARPSyndicate/kenzer-templates "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/103699"
      },
      {
        "trust": 2.1,
        "url": "https://pivotal.io/security/cve-2018-1271"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:1320"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:2669"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:2939"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1271"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1271"
      },
      {
        "trust": 0.6,
        "url": "http://www.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75922"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-guardium-data-encryption-gde-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.3,
        "url": "http://www.springframework.org/"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2018-1271"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1272"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1272"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1305"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1304"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1304"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1275"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1275"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1305"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/22.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=57443"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/x-f1v3/vulnerability_environment"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000129"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2014-0114"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000342"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000352"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000346"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1114"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5397"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14063"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000343"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-14063"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000130"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000342"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000352"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000346"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000339"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000340"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000341"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000341"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-0114"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8088"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000343"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8036"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000344"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000345"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=jboss.fuse\u0026downloadtype=distributions\u0026version=7.1.0"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000340"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000129"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1339"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000180"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1339"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/2939351"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000339"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000130"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8036"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000180"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8088"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5397"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-1000344"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000345"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-12617"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12617"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-7489"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1270"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-7489"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1270"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/3060411"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html/red_hat_openshift_application_runtimes_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=catrhoar.spring.boot\u0026version=1.5.12"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "db": "BID",
        "id": "103699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "db": "BID",
        "id": "103699"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-04-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "date": "2018-04-06T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "BID",
        "id": "103699"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "date": "2018-09-11T15:41:48",
        "db": "PACKETSTORM",
        "id": "149311"
      },
      {
        "date": "2018-10-18T03:51:21",
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "date": "2018-05-04T01:11:44",
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "date": "2018-04-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "date": "2018-04-06T13:29:00.500000",
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122696"
      },
      {
        "date": "2022-06-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1271"
      },
      {
        "date": "2018-04-05T00:00:00",
        "db": "BID",
        "id": "103699"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      },
      {
        "date": "2021-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      },
      {
        "date": "2024-11-21T03:59:30.683000",
        "db": "NVD",
        "id": "CVE-2018-1271"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Path traversal vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003098"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-244"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202009-1625",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "insurance rules palette",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.0"
      },
      {
        "model": "commerce guided search",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.2"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.4"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.6"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2.0"
      },
      {
        "model": "financial services analytical applications infrastructure",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.6"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.19"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.2.5"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.9"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.9"
      },
      {
        "model": "snapcenter",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "goldengate application adapters",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.1.0.0.0"
      },
      {
        "model": "communications brm",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.0.9"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.1.0"
      },
      {
        "model": "communications session report manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.1"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12.0"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.1.0"
      },
      {
        "model": "retail invoice matching",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "communications brm",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0.3"
      },
      {
        "model": "enterprise data quality",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.2.0"
      },
      {
        "model": "enterprise data quality",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.1.18"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.0"
      },
      {
        "model": "communications session report manager",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2.1"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12.0"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12.0"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12.10"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.1.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.0.3"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.4"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.8.10"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.3.6.0.0"
      },
      {
        "model": "hyperion infrastructure technology",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.2.4"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.19"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.8.21"
      },
      {
        "model": "storagetek tape analytics sw tool",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.3"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.5"
      },
      {
        "model": "retail customer management and segmentation foundation",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0.2"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.4"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "financial services analytical applications infrastructure",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.0"
      },
      {
        "model": "insurance policy administration",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "snap creator framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.29"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "storagetek acsls",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.5.1"
      },
      {
        "model": "retail customer engagement",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.12.10"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2.20"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.0.4"
      },
      {
        "model": "oncommand insight",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "primavera p6 enterprise project portfolio management",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.1.0"
      },
      {
        "model": "retail merchandising system",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3"
      },
      {
        "model": "retail bulk data integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3.0"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.23"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "fusion middleware",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "fusion middleware",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "insurance policy administration",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.4"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "model": "communications design studio",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.4.0"
      },
      {
        "model": "retail customer management and segmentation foundation",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.22"
      },
      {
        "model": "primavera gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.8.0"
      },
      {
        "model": "communications design studio",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.5"
      },
      {
        "model": "retail invoice matching",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail customer engagement",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications design studio",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.4"
      },
      {
        "model": "primavera gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2.11"
      },
      {
        "model": "spring framework",
        "scope": null,
        "trust": 0.8,
        "vendor": "pivotal",
        "version": null
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163798"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2020-5421",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CVE-2020-5421",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 1.9,
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "VHN-183546",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "LOW",
            "trust": 0.1,
            "vectorString": "AV:N/AC:H/AU:S/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 1.3,
            "id": "CVE-2020-5421",
            "impactScore": 4.7,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "security@pivotal.io",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.3,
            "id": "CVE-2020-5421",
            "impactScore": 5.8,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2020-5421",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-5421",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "security@pivotal.io",
            "id": "CVE-2020-5421",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2020-5421",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202009-1050",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-975",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-183546",
            "trust": 0.1,
            "value": "LOW"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-5421",
            "trust": 0.1,
            "value": "LOW"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. Spring Framework Contains an unspecified vulnerability.Information may be obtained and information may be tampered with. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. The following products and versions are affected: 5.2.0 - 5.2.8, 5.1.0 to 5.1.17, 5.0.0 to 5.0.18, 4.3.0 to 4.3.28 and earlier unsupported versions. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Moderate: Red Hat Fuse 7.9.0 release and security update\nAdvisory ID:       RHSA-2021:3140-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2021:3140\nIssue date:        2021-08-11\nCVE Names:         CVE-2017-5645 CVE-2017-18640 CVE-2019-12402 \n                   CVE-2019-14887 CVE-2019-16869 CVE-2019-20445 \n                   CVE-2020-1695 CVE-2020-1925 CVE-2020-1935 \n                   CVE-2020-1938 CVE-2020-5410 CVE-2020-5421 \n                   CVE-2020-6950 CVE-2020-9484 CVE-2020-10688 \n                   CVE-2020-10693 CVE-2020-10714 CVE-2020-10719 \n                   CVE-2020-11996 CVE-2020-13920 CVE-2020-13934 \n                   CVE-2020-13935 CVE-2020-13936 CVE-2020-13954 \n                   CVE-2020-13956 CVE-2020-14040 CVE-2020-14297 \n                   CVE-2020-14338 CVE-2020-14340 CVE-2020-17510 \n                   CVE-2020-17518 CVE-2020-25633 CVE-2020-25638 \n                   CVE-2020-25640 CVE-2020-25644 CVE-2020-26258 \n                   CVE-2020-26945 CVE-2020-27216 CVE-2020-28052 \n                   CVE-2021-27807 CVE-2021-27906 CVE-2021-28165 \n=====================================================================\n\n1. Summary:\n\nA minor version update (from 7.8 to 7.9) is now available for Red Hat Fuse. \nThe purpose of this text-only errata is to inform you about the security\nissues fixed in this release. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Description:\n\nThis release of Red Hat Fuse 7.9.0 serves as a replacement for Red Hat Fuse\n7.8, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* hawtio-osgi (CVE-2017-5645)\n\n* prometheus-jmx-exporter: snakeyaml (CVE-2017-18640)\n\n* apache-commons-compress (CVE-2019-12402)\n\n* karaf-transaction-manager-narayana: netty (CVE-2019-16869,\nCVE-2019-20445)\n\n* tomcat (CVE-2020-1935, CVE-2020-1938, CVE-2020-9484, CVE-2020-13934,\nCVE-2020-13935, CVE-2020-11996)\n\n* spring-cloud-config-server (CVE-2020-5410)\n\n* velocity (CVE-2020-13936)\n\n* httpclient: apache-httpclient (CVE-2020-13956)\n\n* shiro-core: shiro (CVE-2020-17510)\n\n* hibernate-core (CVE-2020-25638)\n\n* wildfly-openssl (CVE-2020-25644)\n\n* jetty (CVE-2020-27216, CVE-2021-28165)\n\n* bouncycastle (CVE-2020-28052)\n\n* wildfly (CVE-2019-14887, CVE-2020-25640)\n\n* resteasy-jaxrs: resteasy (CVE-2020-1695)\n\n* camel-olingo4 (CVE-2020-1925)\n\n* springframework (CVE-2020-5421)\n\n* jsf-impl: Mojarra (CVE-2020-6950)\n\n* resteasy (CVE-2020-10688)\n\n* hibernate-validator (CVE-2020-10693)\n\n* wildfly-elytron (CVE-2020-10714)\n\n* undertow (CVE-2020-10719)\n\n* activemq (CVE-2020-13920)\n\n* cxf-core: cxf (CVE-2020-13954)\n\n* fuse-apicurito-operator-container: golang.org/x/text (CVE-2020-14040)\n\n* jboss-ejb-client: wildfly (CVE-2020-14297)\n\n* xercesimpl: wildfly (CVE-2020-14338)\n\n* xnio (CVE-2020-14340)\n\n* flink: apache-flink (CVE-2020-17518)\n\n* resteasy-client (CVE-2020-25633)\n\n* xstream (CVE-2020-26258)\n\n* mybatis (CVE-2020-26945)\n\n* pdfbox (CVE-2021-27807, CVE-2021-27906)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are available from the Fuse 7.9.0 product\ndocumentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability\n1730462 - CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class\n1758619 - CVE-2019-16869 netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers\n1764640 - CVE-2019-12402 apache-commons-compress: Infinite loop in name encoding algorithm\n1772008 - CVE-2019-14887 wildfly: The \u0027enabled-protocols\u0027 value in legacy security is not respected if OpenSSL security provider is in use\n1785376 - CVE-2017-18640 snakeyaml: Billion laughs attack via alias feature\n1790309 - CVE-2020-1925 olingo-odata: Server side request forgery in AsyncResponseWrapperImpl\n1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header\n1805006 - CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371\n1805501 - CVE-2020-10693 hibernate-validator: Improper input validation in the interpolation of constraint error messages\n1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability\n1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling\n1814974 - CVE-2020-10688 RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack\n1825714 - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication\n1828459 - CVE-2020-10719 undertow: invalid HTTP request with large chunk size\n1838332 - CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE\n1845626 - CVE-2020-5410 spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack\n1851420 - CVE-2020-11996 tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS\n1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service\n1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash\n1857024 - CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS\n1857040 - CVE-2020-13934 tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS\n1860054 - CVE-2020-14338 wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl\n1860218 - CVE-2020-14340 xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS\n1879042 - CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client\u0027s WebApplicationException handling\n1880101 - CVE-2020-13920 activemq: improper authentication allows MITM attack\n1881158 - CVE-2020-5421 springframework: RFD protection bypass via jsessionid\n1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used\n1881637 - CVE-2020-25640 wildfly: resource adapter logs plaintext JMS password at warning level on connection error\n1885485 - CVE-2020-25644 wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL\n1886587 - CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs\n1887257 - CVE-2020-26945 mybatis: mishandles deserialization of object streams which could result in remote code execution\n1891132 - CVE-2020-27216 jetty: local temporary directory hijacking vulnerability\n1898235 - CVE-2020-13954 cxf: XSS via the styleSheetPath\n1903727 - CVE-2020-17510 shiro: specially crafted HTTP request may cause an authentication bypass\n1908832 - CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling\n1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible\n1913312 - CVE-2020-17518 apache-flink: directory traversal attack allows remote file writing through the REST API\n1937440 - CVE-2020-13936 velocity: arbitrary code execution when attacker is able to modify templates\n1941050 - CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file\n1941055 - CVE-2021-27807 pdfbox: infinite loop while loading a crafted PDF file\n1945714 - CVE-2021-28165 jetty: Resource exhaustion when receiving an invalid large TLS frame\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-5645\nhttps://access.redhat.com/security/cve/CVE-2017-18640\nhttps://access.redhat.com/security/cve/CVE-2019-12402\nhttps://access.redhat.com/security/cve/CVE-2019-14887\nhttps://access.redhat.com/security/cve/CVE-2019-16869\nhttps://access.redhat.com/security/cve/CVE-2019-20445\nhttps://access.redhat.com/security/cve/CVE-2020-1695\nhttps://access.redhat.com/security/cve/CVE-2020-1925\nhttps://access.redhat.com/security/cve/CVE-2020-1935\nhttps://access.redhat.com/security/cve/CVE-2020-1938\nhttps://access.redhat.com/security/cve/CVE-2020-5410\nhttps://access.redhat.com/security/cve/CVE-2020-5421\nhttps://access.redhat.com/security/cve/CVE-2020-6950\nhttps://access.redhat.com/security/cve/CVE-2020-9484\nhttps://access.redhat.com/security/cve/CVE-2020-10688\nhttps://access.redhat.com/security/cve/CVE-2020-10693\nhttps://access.redhat.com/security/cve/CVE-2020-10714\nhttps://access.redhat.com/security/cve/CVE-2020-10719\nhttps://access.redhat.com/security/cve/CVE-2020-11996\nhttps://access.redhat.com/security/cve/CVE-2020-13920\nhttps://access.redhat.com/security/cve/CVE-2020-13934\nhttps://access.redhat.com/security/cve/CVE-2020-13935\nhttps://access.redhat.com/security/cve/CVE-2020-13936\nhttps://access.redhat.com/security/cve/CVE-2020-13954\nhttps://access.redhat.com/security/cve/CVE-2020-13956\nhttps://access.redhat.com/security/cve/CVE-2020-14040\nhttps://access.redhat.com/security/cve/CVE-2020-14297\nhttps://access.redhat.com/security/cve/CVE-2020-14338\nhttps://access.redhat.com/security/cve/CVE-2020-14340\nhttps://access.redhat.com/security/cve/CVE-2020-17510\nhttps://access.redhat.com/security/cve/CVE-2020-17518\nhttps://access.redhat.com/security/cve/CVE-2020-25633\nhttps://access.redhat.com/security/cve/CVE-2020-25638\nhttps://access.redhat.com/security/cve/CVE-2020-25640\nhttps://access.redhat.com/security/cve/CVE-2020-25644\nhttps://access.redhat.com/security/cve/CVE-2020-26258\nhttps://access.redhat.com/security/cve/CVE-2020-26945\nhttps://access.redhat.com/security/cve/CVE-2020-27216\nhttps://access.redhat.com/security/cve/CVE-2020-28052\nhttps://access.redhat.com/security/cve/CVE-2021-27807\nhttps://access.redhat.com/security/cve/CVE-2021-27906\nhttps://access.redhat.com/security/cve/CVE-2021-28165\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.9.0\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYRQVh9zjgjWX9erEAQjAxg/+O0wRNyDejQCX7SWv2Lvo5YZVE9Azv+hd\npWFbtNu1cruoiUWY2vqArIH8KmZXWYS/EDQCe4PfIB0wKZfx9dS7y19Ct4swE4Y2\n3L0DRVp9YLoqZC3ndVIk3W+RSLEODc5S3IAi6twXlmiZlAwPJXDvcs7aeUAPGc0m\n93Y3lZofrpaEnyEVdoUsz0M47mQQYxNJ1nPF9FuUDsOXUqiu18JS9DsuyWwONyKw\ndPCxfHf3ioI+ymsYjoO+fIcu3dR6lGryvsEFY3dnXePiLlp5NBrRW359K6EQGM/e\nf1PsXzVYrWMikmxpGaOM7KkoLPAcvtznd4G62ZGUODyAEUKLderr9M7zG88Eg2gG\nYcw5D4UkJ+QZB/qHlQJHLrrzuPybGBXSdl2VLTF/m7YZSE9C2yW1ZatyahhdEP3T\n+MmzU6mnbuPCrYjwL/AgCGx3ap52+2eL5HvDzf7+5plY6MVpHZQb2iiIj6H58P6g\nffxr6dGJdDtw5ovzls0Gor4sb69KJ+3xrRLg2C7cndd+3RJc8SCiCRUV9QE2IHTb\nH3cDXlNbYcqzDxQZNUUO13+GOEgXQLrIJokA3zNXzzYFr2tivmiWF6rKrJ6UnECl\n86tpZfh4vcosv3nN6Cg9VAizrMm/84B4L3T4jm/mrN4SGg3CSJqa03r7ig3+oHFX\nH9jzBVxbmuk=\n=jp7z\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "db": "PACKETSTORM",
        "id": "163798"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-5421",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682",
        "trust": 0.8
      },
      {
        "db": "CS-HELP",
        "id": "SB2021042641",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021042319",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042537",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021072778",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022012321",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021042542",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.2731",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.0318",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041363",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-183546",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5421",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "163798",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "PACKETSTORM",
        "id": "163798"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "id": "VAR-202009-1625",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183546"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T21:00:47.174000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2020-5421",
        "trust": 0.8,
        "url": "https://tanzu.vmware.com/security/cve-2020-5421"
      },
      {
        "title": "Pivotal Software Spring Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=128759"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2020-5421",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=e21ac0d0c68c20c593f7e586cb341ec5"
      },
      {
        "title": "ProjetDevJava",
        "trust": 0.1,
        "url": "https://github.com/delaval-htps/ProjetDevJava "
      },
      {
        "title": "Spring \u5b89\u5168\u6f0f\u6d1e CVE-2020-5421\u590d\u73b0",
        "trust": 0.1,
        "url": "https://github.com/pandaMingx/CVE-2020-5421 "
      },
      {
        "title": "Vulnerability_Environment",
        "trust": 0.1,
        "url": "https://github.com/x-f1v3/Vulnerability_Environment "
      },
      {
        "title": "MergeBase LAST UPDATE 07/06/23: Vulnerable w/ Gradle",
        "trust": 0.1,
        "url": "https://github.com/emilywang0/MergeBase_test_vuln "
      },
      {
        "title": "SpringSecurity",
        "trust": 0.1,
        "url": "https://github.com/ax1sX/SpringSecurity "
      },
      {
        "title": "spring-boot-demo con Security CI/CD\nEJECUCION\nErrores\nResultado final\nLog",
        "trust": 0.1,
        "url": "https://github.com/scordero1234/java_sec_demo-main "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/soosmile/POC "
      },
      {
        "title": "PoC in GitHub",
        "trust": 0.1,
        "url": "https://github.com/developer3000S/PoC-in-GitHub "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "Lack of information (CWE-noinfo) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://tanzu.vmware.com/security/cve-2020-5421"
      },
      {
        "trust": 2.4,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 2.4,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "trust": 2.4,
        "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://security.netapp.com/advisory/ntap-20210513-0009/"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5421"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e%40%3cdev.ranger.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3ccommits.ambari.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074%40%3cdev.hive.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211%40%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec%40%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb%40%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc%40%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb%40%3cuser.ignite.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d%40%3cuser.ignite.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665%40%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3ccommits.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1@%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a@%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5@%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf00d8f4101a1c1ea4de6ea1e09ddf7472cfd306745c90d6da87ae074@%3cdev.hive.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rc9efaf6db98bee19db1bc911d0fa442287dac5cb229d4aaa08b6a13d@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r7e6a213eea7f04fc6d9e3bd6eb8d68c4df92a22e956e95cb2c482865@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rd462a8b0dfab4c15e67c0672cd3c211ecd0e4f018f824082ed54f665@%3cissues.hive.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/raf7ca57033e537e4f9d7df7f192fa6968c1e49409b2348e08d807ccb@%3cuser.ignite.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ra889d95141059c6cbe77dd80249bb488ae53b274b5f3abad09d9511d@%3cuser.ignite.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r503e64b43a57fd68229cac4a869d1a9a2eac9e75f8719cad3a840211@%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r918caad55dcc640a16753b00d8d6acb90b4e36de4b6156d0867246ec@%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3589ed0d18edeb79028615080d5a0e8878856436bb91774a3196d9eb@%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rb18ed999153ef0f0cb7af03efe0046c42c7242fd77fbd884a75ecfdc@%3ccommits.pulsar.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/re014a49d77f038ba70e5e9934d400af6653e8c9ac110d32b1254127e@%3cdev.ranger.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6443419"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/vmware-spring-framework-privilege-escalation-via-rfd-protection-bypass-33361"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-a-spring-framework-vulnerability-3/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021072778"
      },
      {
        "trust": 0.6,
        "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-security-bypass-vulnerability-in-spring-framework-affects-ibm-control-center-cve-2020-5421/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-spring-framework-vulnerabilities-affect-ibm-watson-text-to-speech-and-speech-to-text-ibm-watson-speech-services-for-cloud-pak-for-data-1-2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-rational-test-control-panel-affected-by-spring-framework-vulnerability/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-spring-framework-as-used-by-ibm-qradar-siem-is-vulnerable-to-improper-input-validation-cve-2020-5421/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-a-spring-framework-vulnerability-2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021042319"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042537"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.0318/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021042542"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021042641"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.2731"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-a-spring-framework-vulnerability/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-discovery-for-ibm-cloud-pak-for-data-affected-by-vulnerability-in-spring/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022012321"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-spring-framework-affects-ibm-tivoli-application-dependency-discovery-manager-cve-2020-5421-2/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=973381"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/delaval-htps/projetdevjava"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13936"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1925"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-6950"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1935"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-17510"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13956"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14040"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13920"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13954"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-18640"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14040"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2021:3140"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13920"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-5410"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13934"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-27216"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10688"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13934"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14887"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13935"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-28165"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-9484"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14297"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5645"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14338"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10693"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1695"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10714"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11996"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12402"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-12402"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1925"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13954"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25640"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25638"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-5645"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14340"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.fuse\u0026version=7.9.0"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14297"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-17510"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11996"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10719"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13956"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27807"
      },
      {
        "trust": 0.1,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-16869"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-14340"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25633"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-16869"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18640"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-26945"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-25644"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1935"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13936"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-17518"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2021-27906"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-5421"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1938"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1938"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-20445"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20445"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10719"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-28052"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10693"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-17518"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10688"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13935"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1695"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14887"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10714"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "PACKETSTORM",
        "id": "163798"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "db": "PACKETSTORM",
        "id": "163798"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-09-19T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "date": "2020-09-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "date": "2021-04-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "date": "2021-08-12T15:42:56",
        "db": "PACKETSTORM",
        "id": "163798"
      },
      {
        "date": "2020-09-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2020-09-19T04:15:11.527000",
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-03-01T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183546"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5421"
      },
      {
        "date": "2021-04-09T05:31:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      },
      {
        "date": "2022-04-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2024-11-21T05:34:08.303000",
        "db": "NVD",
        "id": "CVE-2020-5421"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163798"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring\u00a0Framework\u00a0 Vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-011682"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202009-1050"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      }
    ],
    "trust": 1.2
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201805-1189",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "openshift",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.3.0"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.5"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.6.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.4"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.1.1"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.0.0.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.1.0.1"
      },
      {
        "model": "hospitality guest access",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.2.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.2"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.0"
      },
      {
        "model": "utilities network management system",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.12.0.3"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.1.0"
      },
      {
        "model": "enterprise manager for mysql database",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.3.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.0.0.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "tape library acsls",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.4"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.2.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.3"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.0.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.17"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.0.0"
      },
      {
        "model": "agile product lifecycle management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.3.6"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "agile product lifecycle management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.3.4"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.2.0.1"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.2.1"
      },
      {
        "model": "agile product lifecycle management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.3.5"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.2"
      },
      {
        "model": "hospitality guest access",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.2.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "communications converged application server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0.0.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.3"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0.3"
      },
      {
        "model": "health sciences information manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "agile product lifecycle management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.3.3"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.2"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.4.0"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.0.5.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.1.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.6"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.0.0"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.3.6.0.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3.17"
      },
      {
        "model": "openshift",
        "scope": null,
        "trust": 0.8,
        "vendor": "red hat",
        "version": null
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3.x"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.x"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.6"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.1"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.17"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.15"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.14"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.6"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.16"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "104260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:redhat:openshift",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd.",
    "sources": [
      {
        "db": "BID",
        "id": "104260"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-1257",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2018-1257",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.0,
            "id": "VHN-122542",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-1257",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-1257",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-1257",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-1257",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201805-405",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122542",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-1257",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. Spring Framework Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Spring Framework is prone to a denial-of-service vulnerability. \nAttackers can exploit this issue to cause a denial-of-service condition; denying service to legitimate users. \nSpring Framework 5.0 through 5.0.5 and 4.3 through 4.3.16 are vulnerable; other versions are also affected. Pivotal Spring Framework is an open source Java and Java EE application framework developed by Pivotal Software in the United States. The framework helps developers build high-quality applications. Description:\n\nRed Hat Openshift Application Runtimes provides an application platform\nthat reduces the complexity of developing and operating applications\n(monoliths and microservices) for OpenShift as a containerized platform. For further\ninformation, refer to the Release Notes linked to in the References\nsection. \n\nSecurity Fix(es):\n\n* spring-messaging: ReDoS Attack with spring-messaging (CVE-2018-1257)\n\n* spring-data: XXE with Spring Dataas XMLBeam integration (CVE-2018-1259)\n\n* spring-security-oauth2: Remote Code Execution with spring-security-oauth2\n(CVE-2018-1260)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. Bugs fixed (https://bugzilla.redhat.com/):\n\n1578578 - CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging\n1578902 - CVE-2018-1259 spring-data-commons: XXE with Spring Dataas XMLBeam integration\n1584376 - CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: Red Hat Fuse 7.2 security update\nAdvisory ID:       RHSA-2018:3768-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:3768\nIssue date:        2018-12-04\nCVE Names:         CVE-2016-5002 CVE-2016-5003 CVE-2017-12196 \n                   CVE-2018-1257 CVE-2018-1259 CVE-2018-1288 \n                   CVE-2018-1336 CVE-2018-8014 CVE-2018-8018 \n                   CVE-2018-8039 CVE-2018-8041 CVE-2018-12537 \n=====================================================================\n\n1. Summary:\n\nAn update is now available for Red Hat Fuse. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Fuse enables integration experts, application developers, and\nbusiness users to collaborate and independently develop connected\nsolutions. \n\nFuse is part of an agile integration solution. Its distributed approach\nallows teams to deploy integrated services where required. The API-centric,\ncontainer-based architecture decouples services so they can be created,\nextended, and deployed independently. \n\nThis release of Red Hat Fuse 7.2 serves as a replacement for Red Hat Fuse\n7.1, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* xmlrpc: Deserialization of untrusted Java object through\n\u003cex:serializable\u003e tag (CVE-2016-5003)\n\n* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)\n\n* ignite: Improper deserialization allows for code execution via\nGridClientJdkMarshaller endpoint (CVE-2018-8018)\n\n* apache-cxf: TLS hostname verification does not work correctly with\ncom.sun.net.ssl.* (CVE-2018-8039)\n\n* xmlrpc: XML external entity vulnerability SSRF via a crafted DTD\n(CVE-2016-5002)\n\n* undertow: Client can use bogus uri in Digest authentication\n(CVE-2017-12196)\n\n* spring-data-commons: XXE with Spring Dataas XMLBeam integration\n(CVE-2018-1259)\n\n* kafka: Users can perform Broker actions via crafted fetch requests,\ninterfering with data replication and causing data lass (CVE-2018-1288)\n\n* tomcat: Insecure defaults in CORS filter enable \u0027supportsCredentials\u0027 for\nall origins (CVE-2018-8014)\n\n* camel-mail: path traversal vulnerability (CVE-2018-8041)\n\n* vertx: Improper neutralization of CRLF sequences allows remote attackers\nto inject arbitrary HTTP response headers (CVE-2018-12537)\n\n* spring-framework: ReDoS Attack with spring-messaging (CVE-2018-1257)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\nRed Hat would like to thank Eedo Shapira (GE Digital) for reporting\nCVE-2018-8041. The CVE-2017-12196 issue was discovered by Jan Stourac (Red\nHat). \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are located in the download section of the\ncustomer portal. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1503055 - CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication\n1508110 - CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD\n1508123 - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through \u003cex:serializable\u003e tag\n1578578 - CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging\n1578902 - CVE-2018-1259 spring-data-commons: XXE with Spring Dataas XMLBeam integration\n1579611 - CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable \u0027supportsCredentials\u0027 for all origins\n1591072 - CVE-2018-12537 vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers\n1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*\n1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS\n1607731 - CVE-2018-8018 ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint\n1611059 - CVE-2018-1288 kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass\n1612644 - CVE-2018-8041 camel-mail: path traversal vulnerability\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-5002\nhttps://access.redhat.com/security/cve/CVE-2016-5003\nhttps://access.redhat.com/security/cve/CVE-2017-12196\nhttps://access.redhat.com/security/cve/CVE-2018-1257\nhttps://access.redhat.com/security/cve/CVE-2018-1259\nhttps://access.redhat.com/security/cve/CVE-2018-1288\nhttps://access.redhat.com/security/cve/CVE-2018-1336\nhttps://access.redhat.com/security/cve/CVE-2018-8014\nhttps://access.redhat.com/security/cve/CVE-2018-8018\nhttps://access.redhat.com/security/cve/CVE-2018-8039\nhttps://access.redhat.com/security/cve/CVE-2018-8041\nhttps://access.redhat.com/security/cve/CVE-2018-12537\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=7.2.0\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.2/\nhttps://access.redhat.com/articles/2939351\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXAakytzjgjWX9erEAQgDkw//Wb1MeuX1VOUq4u9qkgtp3ECPTAR3GE8B\nRWHYBguzM+WJrDPTtgH1sy1BstIEPgVooQLTKWhZYtJpR64S5T6YAv+aFh1vA7qI\n87GDERqiATIm3l8qKBBOF02FukP9ywkaH5hR+pT7tM2OuN8iZ4dvKl0Rdzs6vnhF\nEa+qVCKeQlyn88HUUqYw51nBX7tbK0H1RuG7DxlU93LBYqymMIZ90KhcGeuvNPu/\nBVk7xMDtbdPSagSBy5WFpTvZ/ozeYBmO7u8p9l67SiD3obR6Rtn83B3DKvL/AFP4\nahKlIrK62hk2qgXrpLQ9aVUwBMZ1Lqu99LelF20hRt38L7qy/EXtD+Xdt0H9Xl/H\nbcLyRvjq8pOjdrdqAvnfI5HBDdSZrxujYX9t6egoQg3wFuS9h0DbKFMXSKMSaW2S\nWlP4L5zbCTvhPy3mIPOECKDxP8Xa2g2HnqCal2PpHIXGVBvD0CTuxI0b7a6WKKYf\ndbhm5uIEhdoS/vSuHntq+o+3IzlhRNHKx2Uh+03arWYyj4N26bbKFB+v+7gjL2e9\n1ITf4HXEUphym5PY0R1GGc2Xr5Xc8BjV8xX3pgvI8FcRov4XGsS37TYpvNxPmTCA\ne4VB2C4WS+AFhk1QJR7cNuACwUxjarIoKUp1CX5gvqu35pVgxR97KxoblGdMtR9g\nUOgTm4iHIhQ=\n=RCpd\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "BID",
        "id": "104260"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "db": "PACKETSTORM",
        "id": "148079"
      },
      {
        "db": "PACKETSTORM",
        "id": "150645"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-1257",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "104260",
        "trust": 2.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "148079",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-122542",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1257",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "150645",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "db": "BID",
        "id": "104260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "PACKETSTORM",
        "id": "148079"
      },
      {
        "db": "PACKETSTORM",
        "id": "150645"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "id": "VAR-201805-1189",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T20:42:50.942000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-1257: ReDoS Attack with spring-messaging",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2018-1257"
      },
      {
        "title": "RHSA-2018:1809",
        "trust": 0.8,
        "url": "https://access.redhat.com/errata/RHSA-2018:1809"
      },
      {
        "title": "Pivotal Spring Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80032"
      },
      {
        "title": "Red Hat: Important: Red Hat OpenShift Application Runtimes Spring Boot security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20181809 - Security Advisory"
      },
      {
        "title": "Red Hat: CVE-2018-1257",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2018-1257"
      },
      {
        "title": "Red Hat: Important: Red Hat Fuse 7.2 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20183768 - Security Advisory"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=81c63752a6f26433af2128b2e8c02385"
      },
      {
        "title": "IBM: Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3dea47d76eee003a50f853f241578c37"
      },
      {
        "title": "cybsec",
        "trust": 0.1,
        "url": "https://github.com/ilmari666/cybsec "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-20",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "http://www.securityfocus.com/bid/104260"
      },
      {
        "trust": 2.1,
        "url": "https://pivotal.io/security/cve-2018-1257"
      },
      {
        "trust": 2.0,
        "url": "https://access.redhat.com/errata/rhsa-2018:1809"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:3768"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.0,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1257"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1257"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-guardium-data-encryption-gde-3/"
      },
      {
        "trust": 0.3,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1259"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1259"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1257"
      },
      {
        "trust": 0.2,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/ilmari666/cybsec"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=57884"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=catrhoar.spring.boot\u0026downloadtype=distributions\u0026version=1.5.13"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/red_hat_openshift_application_runtimes_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8018"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5003"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-12537"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8014"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=jboss.fuse\u0026downloadtype=distributions\u0026version=7.2.0"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8041"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1288"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-5002"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.2/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5002"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-5003"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12196"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8018"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8039"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1288"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12537"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/2939351"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8014"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8041"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-12196"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "db": "BID",
        "id": "104260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "PACKETSTORM",
        "id": "148079"
      },
      {
        "db": "PACKETSTORM",
        "id": "150645"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "db": "BID",
        "id": "104260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "db": "PACKETSTORM",
        "id": "148079"
      },
      {
        "db": "PACKETSTORM",
        "id": "150645"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-05-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "date": "2018-05-11T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "date": "2018-05-09T00:00:00",
        "db": "BID",
        "id": "104260"
      },
      {
        "date": "2018-07-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "date": "2018-06-07T15:16:13",
        "db": "PACKETSTORM",
        "id": "148079"
      },
      {
        "date": "2018-12-06T02:15:34",
        "db": "PACKETSTORM",
        "id": "150645"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "date": "2018-05-11T20:29:00.213000",
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-08-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122542"
      },
      {
        "date": "2022-06-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1257"
      },
      {
        "date": "2018-05-09T00:00:00",
        "db": "BID",
        "id": "104260"
      },
      {
        "date": "2018-07-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      },
      {
        "date": "2021-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      },
      {
        "date": "2024-11-21T03:59:28.767000",
        "db": "NVD",
        "id": "CVE-2018-1257"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Input validation vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005091"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Input Validation Error",
    "sources": [
      {
        "db": "BID",
        "id": "104260"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-405"
      }
    ],
    "trust": 0.9
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201805-1190",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.2.1.3"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.1.3.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "14.1.2"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "micros lucas",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "2.9.5"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "hospitality guest access",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "4.2.1"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "health sciences information manager",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.3.3"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "13.2.0.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "13.1.0.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.5.0.3"
      },
      {
        "model": "agile plm",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "9.3.5"
      },
      {
        "model": "agile plm",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "9.3.3"
      },
      {
        "model": "agile plm",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "9.3.6"
      },
      {
        "model": "agile plm",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "9.3.4"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.2"
      },
      {
        "model": "enterprise manager ops center",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.6.0"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "enterprise manager for mysql database",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "communications network integrity",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.6"
      },
      {
        "model": "snapcenter",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "communications performance intelligence center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.3.6.0"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.2.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.3"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2.0.0"
      },
      {
        "model": "oncommand workflow automation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "communications network integrity",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.3.2"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.2.1"
      },
      {
        "model": "enterprise repository",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.1.7.0"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "hospitality guest access",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.2.0"
      },
      {
        "model": "oncommand unified manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "netapp",
        "version": "9.4"
      },
      {
        "model": "spring security",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "pivotal",
        "version": "*"
      },
      {
        "model": "communications converged application server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0.0.1"
      },
      {
        "model": "retail point-of-service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "fuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.3.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.5"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.2.8191"
      },
      {
        "model": "storage automation store",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.3.1.1"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.1.0"
      },
      {
        "model": "tape library acsls",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.4"
      },
      {
        "model": "insurance policy administration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "retail point-of-service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "oncommand insight",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "oncommand unified manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "netapp",
        "version": "7.3"
      },
      {
        "model": "enterprise repository",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "peoplesoft enterprise fin install",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.2"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.6"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.8"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.7"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.5"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.9"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.1"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.2.4"
      },
      {
        "model": "spring security",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "0"
      },
      {
        "model": "spring framework 5.0.5.release",
        "scope": null,
        "trust": 0.3,
        "vendor": "pivotal",
        "version": null
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.3.60"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "utilities network management system",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.12.0.3"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "16.0.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "15.0.3.100"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "14.1.3.37"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "14.0.3.26"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "15.2"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "8.0.2.8191"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.0.6.5281"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.4.9.4237"
      },
      {
        "model": "hospitality guest access",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.2"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.21"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "2.0.0.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1.0.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.0.3.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.0.1.0"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.3.0.0.0"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.2.0.0.0"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1.0.5.0"
      },
      {
        "model": "enterprise manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "13.2.0.0"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.2"
      },
      {
        "model": "endeca information discovery integrator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.1"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.4"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.3.5"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.3.4"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.3.2"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "communications performance intelligence center software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "communications performance intelligence center software",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.1.5.1"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.1.5"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "9.0.3"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "9.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.1"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0.2"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.1.6"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.1"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "8.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "5.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "spring framework 5.0.6.release",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": null
      },
      {
        "model": "communications services gatekeeper",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "communications performance intelligence center software",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "8.3"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "104222"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat,Spring Security Team.",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2018-1258",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2018-1258",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "VHN-122553",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-1258",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-1258",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-1258",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-1258",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201805-404",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122553",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-1258",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted. \nAn attacker can exploit this issue to bypass security restrictions and  perform unauthorized actions. This may aid in further  attacks. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. Pivotal Software Spring Security is a set of security framework provided by American Pivotal Software Company to provide descriptive security protection for Spring-based applications. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: Red Hat Fuse 7.4.0 security update\nAdvisory ID:       RHSA-2019:2413-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2019:2413\nIssue date:        2019-08-08\nCVE Names:         CVE-2016-10750 CVE-2018-1258 CVE-2018-1320\n                   CVE-2018-8088 CVE-2018-10899 CVE-2018-15758\n                   CVE-2019-0192 CVE-2019-3805\n====================================================================\n1. Summary:\n\nA minor version update (from 7.3 to 7.4) is now available for Red Hat Fuse. \nThe purpose of this text-only errata is to inform you about the security\nissues fixed in this release. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nThis release of Red Hat Fuse 7.4.0 serves as a replacement for Red Hat Fuse\n7.3, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* hazelcast: java deserialization in join cluster procedure leading to\nremote code execution (CVE-2016-10750)\n\n* slf4j: Deserialisation vulnerability in EventData constructor can allow\nfor arbitrary code execution (CVE-2018-8088)\n\n* jolokia: system-wide CSRF that could lead to Remote Code Execution\n(CVE-2018-10899)\n\n* spring-security-oauth: Privilege escalation by manipulating saved\nauthorization request (CVE-2018-15758)\n\n* solr: remote code execution due to unsafe deserialization (CVE-2019-0192)\n\n* thrift: SASL negotiation isComplete validation bypass in the\norg.apache.thrift.transport.TSaslTransport class (CVE-2018-1320)\n\n* spring-security-core: Unauthorized Access with Spring Security Method\nSecurity (CVE-2018-1258)\n\n* wildfly: Race condition on PID file allows for termination of arbitrary\nprocesses by local users (CVE-2019-3805)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are available from the Fuse 7.4.0 product\ndocumentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution\n1578582 - CVE-2018-1258 spring-security-core: Unauthorized Access with Spring Security Method Security\n1601037 - CVE-2018-10899 jolokia: system-wide CSRF that could lead to Remote Code Execution\n1643048 - CVE-2018-15758 spring-security-oauth: Privilege escalation by manipulating saved authorization request\n1660263 - CVE-2019-3805 wildfly: Race condition on PID file allows for termination of arbitrary processes by local users\n1667204 - CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class\n1692345 - CVE-2019-0192 solr: remote code execution due to unsafe deserialization\n1713215 - CVE-2016-10750 hazelcast: java deserialization in join cluster procedure leading to remote code execution\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-10750\nhttps://access.redhat.com/security/cve/CVE-2018-1258\nhttps://access.redhat.com/security/cve/CVE-2018-1320\nhttps://access.redhat.com/security/cve/CVE-2018-8088\nhttps://access.redhat.com/security/cve/CVE-2018-10899\nhttps://access.redhat.com/security/cve/CVE-2018-15758\nhttps://access.redhat.com/security/cve/CVE-2019-0192\nhttps://access.redhat.com/security/cve/CVE-2019-3805\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.4.0\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXUv0xNzjgjWX9erEAQhCzRAAjdpuIeE+WhWxaZpzsfh333p6RXGKoB8g\n4BGVD7yZjSNoPmRzkSuaNUTT0wYZdRLSNeYK1FvxqZlTBesHbe3IV80gDNiV2vad\nVzwNYukUoa6s8hdzKY/zCKwhuZ5cWkk+FLjFAPEfZt2Typ3kyYPnK/RxNnzfeSgc\n90xh60LImUIJK/hGyOL40z8pGFbG404TJbdezYnQt0/l0NBGxPqBGOHnIgpZhAgw\ngNMEglpIrxap4UzwSEzA5tmjRUDHeUBpsUpKsez5XL2ECssqrRyK8Hj/KeacnARF\nMnvf4U/lIOamD6Tles8IAFo/kexW+OxKiHbivOFutraLdEXysgkK8Uf5EQqYKW9+\n7OgEuyMxUi5Pbj4kL666iBp5oV95gEHm2zcQEbn65BFJ3nomb5nReHh5t7G0AqHy\nGYj9dlx84+UG0Fr717Vi586KwtCu6rgdZJS25+0kSCeZk/cowYLW09G+j/+Jk3yg\nN/uUfoxqmC/A+SyupFh1A9XZg7oZhkB+Qwo6D2+BejiwXsD8Jv4uzrI7U7+Lg/YK\nUFa2oqArMKNrF0zf9152lqCEpOL8dCO3X8RcB8LmQcapmr1MYGB+18oNT4o3JcY3\nAa1hoi5+2gGgR7HHuqTsxnDXYPtgqR9CMylc5gmYsMFK5W3sNX8Z/qazoH3fIVtu\nNNAto03aZgE=rpUB\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "BID",
        "id": "104222"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "db": "PACKETSTORM",
        "id": "153980"
      }
    ],
    "trust": 2.16
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-1258",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "104222",
        "trust": 2.1
      },
      {
        "db": "SECTRACK",
        "id": "1041896",
        "trust": 1.8
      },
      {
        "db": "SECTRACK",
        "id": "1041888",
        "trust": 1.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "153980",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.3040",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-122553",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1258",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "db": "BID",
        "id": "104222"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "PACKETSTORM",
        "id": "153980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "id": "VAR-201805-1190",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T20:02:57.708000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-1258: Unauthorized Access with Spring Security Method Security",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2018-1258"
      },
      {
        "title": "Pivotal Spring Security  and Spring Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80031"
      },
      {
        "title": "Red Hat: Important: Red Hat Fuse 7.4.0 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20192413 - Security Advisory"
      },
      {
        "title": "Red Hat: CVE-2018-1258",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2018-1258"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=81c63752a6f26433af2128b2e8c02385"
      },
      {
        "title": "nvd_scrapper",
        "trust": 0.1,
        "url": "https://github.com/abhav/nvd_scrapper "
      },
      {
        "title": "cybsec",
        "trust": 0.1,
        "url": "https://github.com/ilmari666/cybsec "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-863",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-285",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "http://www.securityfocus.com/bid/104222"
      },
      {
        "trust": 2.7,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
      },
      {
        "trust": 2.5,
        "url": "https://access.redhat.com/errata/rhsa-2019:2413"
      },
      {
        "trust": 2.4,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 2.1,
        "url": "https://pivotal.io/security/cve-2018-1258"
      },
      {
        "trust": 2.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      },
      {
        "trust": 2.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
      },
      {
        "trust": 2.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
      },
      {
        "trust": 1.8,
        "url": "https://security.netapp.com/advisory/ntap-20181018-0002/"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1041888"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1041896"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1258"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1258"
      },
      {
        "trust": 0.6,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/153980/red-hat-security-advisory-2019-2413-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.3040/"
      },
      {
        "trust": 0.6,
        "url": "https://www.oracle.com/security-alerts/cpujan2020verbose.html"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/863.html"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=57883"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/abhav/nvd_scrapper"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.fuse\u0026version=7.4.0"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1320"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-10899"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-10750"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-0192"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-8088"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10899"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1320"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2016-10750"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-15758"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-8088"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-0192"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3805"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-15758"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3805"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "db": "BID",
        "id": "104222"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "PACKETSTORM",
        "id": "153980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "db": "BID",
        "id": "104222"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "db": "PACKETSTORM",
        "id": "153980"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-05-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "date": "2018-05-11T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "date": "2018-05-09T00:00:00",
        "db": "BID",
        "id": "104222"
      },
      {
        "date": "2018-07-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "date": "2019-08-08T14:34:03",
        "db": "PACKETSTORM",
        "id": "153980"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "date": "2018-05-11T20:29:00.260000",
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122553"
      },
      {
        "date": "2022-04-11T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1258"
      },
      {
        "date": "2019-07-17T09:00:00",
        "db": "BID",
        "id": "104222"
      },
      {
        "date": "2018-07-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      },
      {
        "date": "2021-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      },
      {
        "date": "2024-11-21T03:59:28.953000",
        "db": "NVD",
        "id": "CVE-2018-1258"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Authorization vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-005018"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201805-404"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202001-1870",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "siebel engineering - installer \\\u0026 deployment",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "2.1.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.1"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.2.0"
      },
      {
        "model": "communications element manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.4"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3"
      },
      {
        "model": "retail returns management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0.0"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "flexcube private banking",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.0"
      },
      {
        "model": "data availability services",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.0"
      },
      {
        "model": "enterprise manager base platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.1.0"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2"
      },
      {
        "model": "snapcenter",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.16"
      },
      {
        "model": "communications billing and revenue management elastic charging engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.1.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3.0"
      },
      {
        "model": "mysql",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.12"
      },
      {
        "model": "retail bulk data integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.1.13"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "mysql",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.0"
      },
      {
        "model": "financial services regulatory reporting with agilereporter",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.9.2.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.0"
      },
      {
        "model": "communications session route manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail central office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3.0"
      },
      {
        "model": "communications session route manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.4"
      },
      {
        "model": "insurance calculation engine",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0.2"
      },
      {
        "model": "communications cloud native core policy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.5.0"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.1.0"
      },
      {
        "model": "mysql",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.0.2"
      },
      {
        "model": "communications billing and revenue management elastic charging engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "communications session route manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "mysql",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.20"
      },
      {
        "model": "retail back office",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.0.3"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "communications session report manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.1"
      },
      {
        "model": "communications session report manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.0"
      },
      {
        "model": "insurance policy administration j2ee",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.2.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.2"
      },
      {
        "model": "rapid planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1"
      },
      {
        "model": "retail point-of-service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail service backbone",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.0"
      },
      {
        "model": "communications element manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.3"
      },
      {
        "model": "communications element manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.1"
      },
      {
        "model": "retail assortment planning",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "communications session report manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.2.0"
      },
      {
        "model": "spring framework",
        "scope": null,
        "trust": 0.8,
        "vendor": "pivotal",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "160562"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2020-5398",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "CVE-2020-5398",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "VHN-183523",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:H/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.6,
            "id": "CVE-2020-5398",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "security@pivotal.io",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.3,
            "id": "CVE-2020-5398",
            "impactScore": 6.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2020-5398",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-5398",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "security@pivotal.io",
            "id": "CVE-2020-5398",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2020-5398",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-975",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202001-839",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-183523",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-5398",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input. Spring Framework Contains a vulnerability in the integrity verification of downloaded code.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. A cross-site scripting vulnerability exists in Pivotal Software Spring Framework 5.2.x prior to 5.2.3, 5.1.x prior to 5.1.13, and 5.0.x prior to 5.0.16. A remote attacker could exploit this vulnerability to obtain sensitive information by conducting a Reflected File Download (RFD) attack. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: Red Hat Fuse 7.8.0 release and security update\nAdvisory ID:       RHSA-2020:5568-01\nProduct:           Red Hat JBoss Fuse\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:5568\nIssue date:        2020-12-16\nCVE Names:         CVE-2018-1000873 CVE-2019-0205 CVE-2019-0210\n                   CVE-2019-2692 CVE-2019-3773 CVE-2019-3774\n                   CVE-2019-10202 CVE-2019-10219 CVE-2019-11777\n                   CVE-2019-12406 CVE-2019-12423 CVE-2019-13990\n                   CVE-2019-14900 CVE-2019-17566 CVE-2019-17638\n                   CVE-2019-19343 CVE-2020-1714 CVE-2020-1719\n                   CVE-2020-1950 CVE-2020-1960 CVE-2020-5398\n                   CVE-2020-7226 CVE-2020-9488 CVE-2020-9489\n                   CVE-2020-10683 CVE-2020-10740 CVE-2020-11612\n                   CVE-2020-11971 CVE-2020-11972 CVE-2020-11973\n                   CVE-2020-11980 CVE-2020-11989 CVE-2020-11994\n                   CVE-2020-13692 CVE-2020-13933 CVE-2020-14326\n====================================================================\n1. Summary:\n\nA minor version update (from 7.7 to 7.8) is now available for Red Hat Fuse. \nThe purpose of this text-only errata is to inform you about the security\nissues fixed in this release. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Description:\n\nThis release of Red Hat Fuse 7.8.0 serves as a replacement for Red Hat Fuse\n7.7, and includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. \n\nSecurity Fix(es):\n\n* libquartz: XXE attacks via job description (CVE-2019-13990)\n\n* jetty: double release of resource can lead to information disclosure\n(CVE-2019-17638)\n\n* keycloak: Lack of checks in ObjectInputStream leading to Remote Code\nExecution (CVE-2020-1714)\n\n* springframework: RFD attack via Content-Disposition Header sourced from\nrequest input by Spring MVC or Spring WebFlux Application (CVE-2020-5398)\n\n* wildfly: unsafe deserialization in Wildfly Enterprise Java Beans\n(CVE-2020-10740)\n\n* camel: RabbitMQ enables Java deserialization by default which could leed\nto remote code execution (CVE-2020-11972)\n\n* camel: Netty enables Java deserialization by default which could leed to\nremote code execution (CVE-2020-11973)\n\n* shiro: spring dynamic controllers, a specially crafted request may cause\nan authentication bypass (CVE-2020-11989)\n\n* camel: server-side template injection and arbitrary file disclosure on\ntemplating components (CVE-2020-11994)\n\n* postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML\n(CVE-2020-13692)\n\n* shiro: specially crafted HTTP request may cause an authentication bypass\n(CVE-2020-13933)\n\n* RESTEasy: Caching routes in RootNode may result in DoS (CVE-2020-14326)\n\n* jackson-modules-java8: DoS due to an Improper Input Validation\n(CVE-2018-1000873)\n\n* thrift: Endless loop when feed with specific input data (CVE-2019-0205)\n\n* thrift: Out-of-bounds read related to TJSONProtocol or\nTSimpleJSONProtocol (CVE-2019-0210)\n\n* mysql-connector-java: privilege escalation in MySQL connector\n(CVE-2019-2692)\n\n* spring-ws: XML External Entity Injection (XXE) when receiving XML data\nfrom untrusted sources (CVE-2019-3773)\n\n* spring-batch: XML External Entity Injection (XXE) when receiving XML data\nfrom untrusted sources (CVE-2019-3774)\n\n* codehaus: incomplete fix for unsafe deserialization in jackson-databind\nvulnerabilities (CVE-2019-10202)\n\n* hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)\n\n* org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT\nlibrary (CVE-2019-11777)\n\n* cxf: does not restrict the number of message attachments (CVE-2019-12406)\n\n* cxf: OpenId Connect token service does not properly validate the clientId\n(CVE-2019-12423)\n\n* hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)\n\n* batik: SSRF via \"xlink:href\" (CVE-2019-17566)\n\n* Undertow: Memory Leak in Undertow HttpOpenListener due to holding\nremoting connections indefinitely (CVE-2019-19343)\n\n* Wildfly: EJBContext principal is not popped back after invoking another\nEJB using a different Security Domain (CVE-2020-1719)\n\n* apache-flink: JMX information disclosure vulnerability (CVE-2020-1960)\n\n* cryptacular: excessive memory allocation during a decode operation\n(CVE-2020-7226)\n\n* tika-core: Denial of Service Vulnerabilities in Some of Apache Tika\u0027s\nParsers (CVE-2020-9489)\n\n* dom4j: XML External Entity vulnerability in default SAX parser\n(CVE-2020-10683)\n\n* netty: compression/decompression codecs don\u0027t enforce limits on buffer\nallocation sizes (CVE-2020-11612)\n\n* camel: DNS Rebinding in JMX Connector could result in remote command\nexecution (CVE-2020-11971)\n\n* karaf: A remote client could create MBeans from arbitrary URLs\n(CVE-2020-11980)\n\n* tika: excessive memory usage in PSDParser (CVE-2020-1950)\n\n* log4j: improper validation of certificate with host mismatch in SMTP\nappender (CVE-2020-9488)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nInstallation instructions are available from the Fuse 7.8.0 product\ndocumentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1665601 - CVE-2018-1000873 jackson-modules-java8: DoS due to an Improper Input Validation\n1666499 - CVE-2019-14900 hibernate: SQL injection issue in Hibernate ORM\n1670593 - CVE-2019-3773 spring-ws: XML External Entity Injection (XXE) when receiving XML data from untrusted sources\n1670597 - CVE-2019-3774 spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources\n1694235 - CVE-2020-10683 dom4j: XML External Entity vulnerability in default SAX parser\n1703402 - CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector\n1705975 - CVE-2020-1714 keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution\n1731271 - CVE-2019-10202 codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities\n1738673 - CVE-2019-10219 hibernate-validator: safeHTML validator allows XSS\n1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol\n1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data\n1780445 - CVE-2019-19343 Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely\n1796617 - CVE-2020-1719 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain\n1797006 - CVE-2019-12423 cxf: OpenId Connect token service does not properly validate the clientId\n1799475 - CVE-2020-5398 springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application\n1801149 - CVE-2019-13990 libquartz: XXE attacks via job description\n1801380 - CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation\n1816170 - CVE-2019-12406 cxf: does not restrict the number of message attachments\n1816216 - CVE-2020-11612 netty: compression/decompression codecs don\u0027t enforce limits on buffer allocation sizes\n1822759 - CVE-2020-1950 tika: excessive memory usage in PSDParser\n1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender\n1834512 - CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans\n1848126 - CVE-2020-1960 apache-flink: JMX information disclosure vulnerability\n1848433 - CVE-2020-11971 camel: DNS Rebinding in JMX Connector could result in remote command execution\n1848464 - CVE-2020-11972 camel: RabbitMQ enables Java deserialization by default which could leed to remote code execution\n1848465 - CVE-2020-11973 camel: Netty enables Java deserialization by default which could leed to remote code execution\n1848617 - CVE-2019-17566 batik: SSRF via \"xlink:href\"\n1850042 - CVE-2020-9489 tika-core: Denial of Service Vulnerabilities in Some of Apache Tika\u0027s Parsers\n1850069 - CVE-2020-11989 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass\n1850450 - CVE-2020-11980 karaf: A remote client could create MBeans from arbitrary URLs\n1852985 - CVE-2020-13692 postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML\n1855786 - CVE-2020-11994 camel: server-side template injection and arbitrary file disclosure on templating components\n1855826 - CVE-2020-14326 RESTEasy: Caching routes in RootNode may result in DoS\n1864680 - CVE-2019-17638 jetty: double release of resource can lead to information disclosure\n1869860 - CVE-2020-13933 shiro: specially crafted HTTP request may cause an authentication bypass\n1879743 - CVE-2019-11777 org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-1000873\nhttps://access.redhat.com/security/cve/CVE-2019-0205\nhttps://access.redhat.com/security/cve/CVE-2019-0210\nhttps://access.redhat.com/security/cve/CVE-2019-2692\nhttps://access.redhat.com/security/cve/CVE-2019-3773\nhttps://access.redhat.com/security/cve/CVE-2019-3774\nhttps://access.redhat.com/security/cve/CVE-2019-10202\nhttps://access.redhat.com/security/cve/CVE-2019-10219\nhttps://access.redhat.com/security/cve/CVE-2019-11777\nhttps://access.redhat.com/security/cve/CVE-2019-12406\nhttps://access.redhat.com/security/cve/CVE-2019-12423\nhttps://access.redhat.com/security/cve/CVE-2019-13990\nhttps://access.redhat.com/security/cve/CVE-2019-14900\nhttps://access.redhat.com/security/cve/CVE-2019-17566\nhttps://access.redhat.com/security/cve/CVE-2019-17638\nhttps://access.redhat.com/security/cve/CVE-2019-19343\nhttps://access.redhat.com/security/cve/CVE-2020-1714\nhttps://access.redhat.com/security/cve/CVE-2020-1719\nhttps://access.redhat.com/security/cve/CVE-2020-1950\nhttps://access.redhat.com/security/cve/CVE-2020-1960\nhttps://access.redhat.com/security/cve/CVE-2020-5398\nhttps://access.redhat.com/security/cve/CVE-2020-7226\nhttps://access.redhat.com/security/cve/CVE-2020-9488\nhttps://access.redhat.com/security/cve/CVE-2020-9489\nhttps://access.redhat.com/security/cve/CVE-2020-10683\nhttps://access.redhat.com/security/cve/CVE-2020-10740\nhttps://access.redhat.com/security/cve/CVE-2020-11612\nhttps://access.redhat.com/security/cve/CVE-2020-11971\nhttps://access.redhat.com/security/cve/CVE-2020-11972\nhttps://access.redhat.com/security/cve/CVE-2020-11973\nhttps://access.redhat.com/security/cve/CVE-2020-11980\nhttps://access.redhat.com/security/cve/CVE-2020-11989\nhttps://access.redhat.com/security/cve/CVE-2020-11994\nhttps://access.redhat.com/security/cve/CVE-2020-13692\nhttps://access.redhat.com/security/cve/CVE-2020-13933\nhttps://access.redhat.com/security/cve/CVE-2020-14326\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.fuse\u0026version=7.8.0\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBX9n5stzjgjWX9erEAQhLEA/+P1hIAPgSOz6uLDvvZvm73qyxbuISD92X\nkJ158V+IX64dMlCuUCfFFKiuRCsDzhCSi52P4m8q06OskS1QndEmjfSixER/pG8X\nYJKatVpbxbVE3V2U/wRRfrG/j18UhwNatS3VouvdKOXwQewWb0TaGwGJ9wdZLDMd\n7owlOwqQ1dOh2AMS3NWAeNBSzQtfk0GUb61+V1WRdCBs/PII1roRJyZEGEBsIZtg\nz66CncAjMwL7zj/ZRYK7ogWL20HwMgCQ3oAHo1ENM5k6o7scqRArhMKPthdtF88y\nAwqPo8ocQCE5JB66tbUie6ze2sYPgBflWSJ0zEv3suyUbzLyO2d1utzyXn24ffYN\n0F1gY0YFsLiNRZPfdtGx+cPB5dlBOnnJUOTXA1e87CXohPRKqWuqQaxChGQY8CiH\nZiWg2U/NLuBgg7SkL1Vm9Fqfe06roAfDQLL4nnd8BcRkmhNWG7KL2ve2fRDbfqKT\nRH9x3XbHhD0cfvTFaEj0qVojsSCjVrE+SeJdluDY21kf0OxspVDMffQ0WD2cNVFh\nPgaQJt4ItTfkanw7cKs1GNH4WjMmpuAfe2lzR3JBLlkSvf7iqiPVIrIY+NAOHYG0\nMtx6d3mbwr91KjGg3lXOoM+tTFjOiCZMr/k7WIt3VllJpBP18cbAXeGtEmpMg+jA\nf8t2frnd7kM=jGVK\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "db": "PACKETSTORM",
        "id": "160562"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-5398",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839",
        "trust": 0.7
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041363",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021042844",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021072772",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021072132",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.4464",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3485",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-183523",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5398",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "160562",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "PACKETSTORM",
        "id": "160562"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "id": "VAR-202001-1870",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T19:29:29.275000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2020-5398: RFD Attack via \u201cContent-Disposition\u201d Header Sourced from Request Input by Spring MVC or Spring WebFlux Application",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2020-5398"
      },
      {
        "title": "Pivotal Software Spring Framework Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110175"
      },
      {
        "title": "Red Hat: Important: Red Hat Fuse 7.8.0 release and security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20205568 - Security Advisory"
      },
      {
        "title": "CVE-2020-5398 - RFD(Reflected File Download) Attack for Spring MVC",
        "trust": 0.1,
        "url": "https://github.com/motikan2010/CVE-2020-5398 "
      },
      {
        "title": "Wapiti - Web Vulnerability Scanner",
        "trust": 0.1,
        "url": "https://github.com/wapiti-scanner/wapiti "
      },
      {
        "title": "SpringSecurity",
        "trust": 0.1,
        "url": "https://github.com/ax1sX/SpringSecurity "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/pctF/vulnerable-app "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-494",
        "trust": 1.9
      },
      {
        "problemtype": "CWE-79",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
      },
      {
        "trust": 2.3,
        "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
      },
      {
        "trust": 2.3,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 2.3,
        "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
      },
      {
        "trust": 2.3,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://pivotal.io/security/cve-2020-5398"
      },
      {
        "trust": 1.7,
        "url": "https://security.netapp.com/advisory/ntap-20210917-0006/"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5398"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc05acaacad089613e9642f939b3a44f7199b5537493945c3e045287f%40%3cdev.geode.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163%40%3ccommits.ambari.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r7361bfe84bde9d233f9800c3a96673e7bd81207549ced0236f07a29d%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rf8dc72b974ee74f17bce661ea7d124e733a1f4c4f236354ac0cf48e8%40%3ccommits.camel.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rdcaadaa9a68b31b7d093d76eacfaacf6c7a819f976b595c75ad2d4dc%40%3cdev.geode.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r4639e821ef9ca6ca10887988f410a60261400a7766560e7a97a22efc%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r4b1886e82cc98ef38f582fef7d4ea722e3fcf46637cd4674926ba682%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rab0de39839b4c208dcd73f01e12899dc453361935a816a784548e048%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rc9c7f96f08c8554225dba9050ea5e64bebc129d0d836303143fe3160%40%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r74f81f93a9b69140fe41e236afa7cbe8dfa75692e7ab31a468fddaa0%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r712a6fce928e24e7b6ec30994a7e115a70f1f6e4cf2c2fbf0347ce46%40%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8736185eb921022225a83e56d7285a217fd83f5524bd64a6ca3bf5cc%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a%40%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r6dac0e365d1b2df9a7ffca12b4195181ec14ff0abdf59e1fdb088ce5%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/reaa8a6674baf2724b1b88a621b0d72d9f7a6f5577c88759842c16eb6%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r2dfd5b331b46d3f90c4dd63a060e9f04300468293874bd7e41af7163%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r7d5e518088e2e778928b02bcd3be3b948b59acefe2f0ebb57ec2ebb0%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a0c5e7585a02d%40%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a%40%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r3765353ff434fd00d8fa5a44734b3625a06eeb2a3fb468da7dfae134%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5%40%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r8cc37a60a5056351377ee5f1258f2a4fdd39822a257838ba6bcc1e88%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9fb1ee08cf337d16c3364feb0f35a072438c1a956afd7b77859aa090%40%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r881fb5a95ab251106fed38f836257276feb026bfe01290e72ff91c2a%40%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rb4d1fc078f086ec2e98b2693e8b358e58a6a4ef903ceed93a1ee2b18%40%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/ra996b56e1f5ab2fed235a8b91fa0cc3cf34c2e9fee290b7fa4380a0d%40%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r645408661a8df9158f49e337072df39838fa76da629a7e25a20928a6%40%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1%40%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://lists.apache.org/thread.html/rded5291e25a4c4085a6d43cf262e479140198bf4eabb84986e0a1ef3%40%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5398"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r27552d2fa10d96f2810c50d16ad1fd1899e37796c81a0c5e7585a02d@%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r645408661a8df9158f49e337072df39838fa76da629a7e25a20928a6@%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r712a6fce928e24e7b6ec30994a7e115a70f1f6e4cf2c2fbf0347ce46@%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r881fb5a95ab251106fed38f836257276feb026bfe01290e72ff91c2a@%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ra996b56e1f5ab2fed235a8b91fa0cc3cf34c2e9fee290b7fa4380a0d@%3ccommits.servicecomb.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rded5291e25a4c4085a6d43cf262e479140198bf4eabb84986e0a1ef3@%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3ccommits.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9f13cccb214495e14648d2c9b8f2c6072fd5219e74502dd35ede81e1@%3cdev.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1eccdbd7986618a7319ee7a533bd9d9bf6e8678e59dd4cca9b5b2d7a@%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r5c95eff679dfc642e9e4ab5ac6d202248a59cb1e9457cfbe8b729ac5@%3cissues.ambari.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rf8dc72b974ee74f17bce661ea7d124e733a1f4c4f236354ac0cf48e8@%3ccommits.camel.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rc05acaacad089613e9642f939b3a44f7199b5537493945c3e045287f@%3cdev.geode.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rdcaadaa9a68b31b7d093d76eacfaacf6c7a819f976b595c75ad2d4dc@%3cdev.geode.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r3765353ff434fd00d8fa5a44734b3625a06eeb2a3fb468da7dfae134@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r0f3530f7cb510036e497532ffc4e0bd0b882940448cf4e233994b08b@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r7d5e518088e2e778928b02bcd3be3b948b59acefe2f0ebb57ec2ebb0@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r74f81f93a9b69140fe41e236afa7cbe8dfa75692e7ab31a468fddaa0@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/reaa8a6674baf2724b1b88a621b0d72d9f7a6f5577c88759842c16eb6@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8cc37a60a5056351377ee5f1258f2a4fdd39822a257838ba6bcc1e88@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rb4d1fc078f086ec2e98b2693e8b358e58a6a4ef903ceed93a1ee2b18@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1accbd4f31ad2f40e1661d70a4510a584eb3efd1e32e8660ccf46676@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r6dac0e365d1b2df9a7ffca12b4195181ec14ff0abdf59e1fdb088ce5@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r4639e821ef9ca6ca10887988f410a60261400a7766560e7a97a22efc@%3ccommits.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r9fb1ee08cf337d16c3364feb0f35a072438c1a956afd7b77859aa090@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r7361bfe84bde9d233f9800c3a96673e7bd81207549ced0236f07a29d@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r8736185eb921022225a83e56d7285a217fd83f5524bd64a6ca3bf5cc@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r1bc5d673c01cfbb8e4a91914e9748ead3e5f56b61bca54d314c0419b@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r028977b9b9d44a89823639aa3296fb0f0cfdd76b4450df89d3c4fbbf@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r4b1886e82cc98ef38f582fef7d4ea722e3fcf46637cd4674926ba682@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rab0de39839b4c208dcd73f01e12899dc453361935a816a784548e048@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r2dfd5b331b46d3f90c4dd63a060e9f04300468293874bd7e41af7163@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/r0f2d0ae1bad2edb3d4a863d77f3097b5e88cfbdae7b809f4f42d6aad@%3cissues.karaf.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/rc9c7f96f08c8554225dba9050ea5e64bebc129d0d836303143fe3160@%3cdev.rocketmq.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021072772"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.4464/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021072132"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/spring-framework-file-reading-via-content-disposition-reflected-file-download-31360"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021042844"
      },
      {
        "trust": 0.6,
        "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3485/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1719"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.fuse\u0026version=7.8.0"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12406"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11973"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11972"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-2692"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-9488"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000873"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11989"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10740"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17566"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-13990"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11980"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11972"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1950"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-12406"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11989"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3774"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-0210"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11612"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11980"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1960"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-0205"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-1393"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11971"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-17566"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1000873"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-7226"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10219"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-9489"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-14326"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13692"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-14900"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-0210"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10202"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10202"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10683"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13990"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3773"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-13692"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10683"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11994"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-10219"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11973"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-1714"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-5398"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11777"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-14900"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-13933"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-12423"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-3774"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-10740"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2020-11612"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-17638"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-12423"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17638"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-2692"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19343"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11994"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11971"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-19343"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:5568"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-3773"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-0205"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2019-11777"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "PACKETSTORM",
        "id": "160562"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "db": "PACKETSTORM",
        "id": "160562"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-01-17T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "date": "2020-01-17T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "date": "2020-02-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "date": "2020-12-16T18:17:52",
        "db": "PACKETSTORM",
        "id": "160562"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2020-01-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      },
      {
        "date": "2020-01-17T00:15:12.103000",
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-07-25T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183523"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5398"
      },
      {
        "date": "2020-02-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2022-07-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      },
      {
        "date": "2024-11-21T05:34:04.053000",
        "db": "NVD",
        "id": "CVE-2020-5398"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "160562"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-839"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Vulnerabilities in the integrity of downloaded code",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-001405"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      }
    ],
    "trust": 0.6
  }
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201804-1673",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "tape library acsls",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "8.4"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "14.1"
      },
      {
        "model": "retail predictive application server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "5.2"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "5.1"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "retail order broker",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "6.0.1"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "17.12"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "16.2"
      },
      {
        "model": "primavera gateway",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "15.2"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "11.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "11.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.1"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.0"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "10.1.1"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.3.2.1"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.3.1.1"
      },
      {
        "model": "goldengate for big data",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "oracle",
        "version": "12.2.0.1"
      },
      {
        "model": "insurance calculation engine",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.6.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.0.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.1.0.1"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "5.3.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.0"
      },
      {
        "model": "communications performance intelligence center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.0.5"
      },
      {
        "model": "communications diameter signaling router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.3"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.2.0.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.2.0.1"
      },
      {
        "model": "service architecture leveraging tuxedo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "4.3.16"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "13.3.0.1"
      },
      {
        "model": "communications services gatekeeper",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "6.1.0.4.0"
      },
      {
        "model": "communications converged application server",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.0.0.1"
      },
      {
        "model": "healthcare master person index",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "4.0"
      },
      {
        "model": "application testing suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.5.0.3"
      },
      {
        "model": "health sciences information manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.0"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "10.2"
      },
      {
        "model": "retail customer insights",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "pivotal",
        "version": "5.0.1"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "4.3.16"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.3"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.1"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.4"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "4.3.2"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "pivotal",
        "version": "5.0.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.15"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.14"
      },
      {
        "model": "spring framework",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3"
      },
      {
        "model": "soa suite",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "soa suite",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1.3.0.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0"
      },
      {
        "model": "retail open commerce platform",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "5.3"
      },
      {
        "model": "insurance rules palette",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "10.2.0"
      },
      {
        "model": "goldengate application adapters",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.3.2.1.1"
      },
      {
        "model": "flexcube investor servicing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "14.0"
      },
      {
        "model": "flexcube investor servicing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.4"
      },
      {
        "model": "flexcube investor servicing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.3"
      },
      {
        "model": "flexcube investor servicing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.1"
      },
      {
        "model": "flexcube investor servicing",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "12.0.4"
      },
      {
        "model": "communications webrtc session controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.1"
      },
      {
        "model": "communications webrtc session controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.0"
      },
      {
        "model": "communications webrtc session controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "0"
      },
      {
        "model": "communications service broker",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.0"
      },
      {
        "model": "communications online mediation controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.1"
      },
      {
        "model": "communications converged application server service controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "6.1"
      },
      {
        "model": "communications converged application server service controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "-6.1"
      },
      {
        "model": "communications converged application server service controller",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "-6.0"
      },
      {
        "model": "big data discovery",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "1.6"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "5.0.5"
      },
      {
        "model": "spring framework",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "pivotal",
        "version": "4.3.16"
      },
      {
        "model": "communications webrtc session controller",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "7.2"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:pivotal_software:spring_framework",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "and 0c0c0f.,rwx, Christoph Dreis",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2018-1275",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2018-1275",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-122740",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2018-1275",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-1275",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-1275",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-1275",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201804-563",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122740",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-1275",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework. Spring Framework Contains a security check vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. \nNOTE: This issue is the result of an incomplete fix for the issue described in BID 103696 (Pivotal Spring Framework CVE-2018-1270 Remote Code Execution Vulnerability). Pivotal Spring Framework is an open source Java and Java EE application framework developed by Pivotal Software in the United States. The framework helps developers build high-quality applications. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Critical: Red Hat OpenShift Application Runtimes security and bug fix update\nAdvisory ID:       RHSA-2018:1320-01\nProduct:           Red Hat OpenShift Application Runtimes\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:1320\nIssue date:        2018-05-03\nCVE Names:         CVE-2018-1271 CVE-2018-1272 CVE-2018-1275 \n                   CVE-2018-1304 CVE-2018-1305 \n=====================================================================\n\n1. Summary:\n\nAn update is now available for Red Hat OpenShift Application Runtimes. \n\nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Openshift Application Runtimes provides an application platform\nthat reduces the complexity of developing and operating applications\n(monoliths and microservices) for OpenShift as a containerized platform. \n\nThis release of RHOAR Spring Boot 1.5.12 serves as a replacement for RHOAR\nSpring Boot 1.5.10, and includes bug fixes and enhancements. For further\ninformation, refer to the Release Notes linked to in the References\nsection. \n\nSecurity Fix(es):\n\n* spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275)\n\n* spring-framework: Directory traversal vulnerability with static resources\non Windows filesystems (CVE-2018-1271)\n\n* tomcat: Incorrect handling of empty string URL in security constraints\ncan lead to unintended exposure of resources (CVE-2018-1304)\n\n* tomcat: Late application of security constraints can lead to resource\nexposure for unauthorised users (CVE-2018-1305)\n\n* spring-framework: Multipart content pollution (CVE-2018-1272)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\n3. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users\n1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources\n1564408 - CVE-2018-1272 spring-framework: Multipart content pollution\n1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270\n1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-1271\nhttps://access.redhat.com/security/cve/CVE-2018-1272\nhttps://access.redhat.com/security/cve/CVE-2018-1275\nhttps://access.redhat.com/security/cve/CVE-2018-1304\nhttps://access.redhat.com/security/cve/CVE-2018-1305\nhttps://access.redhat.com/security/updates/classification/#critical\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=catRhoar.spring.boot\u0026version=1.5.12\nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html/red_hat_openshift_application_runtimes_release_notes/\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFa60G7XlSAg2UNWIIRApKzAKCZF1t3YH8mPwN6Q3TN9nAxp9mZHQCglRth\nc3tFEafC+xcftRfJKlS6jU4=\n=NRhi\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "BID",
        "id": "103771"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-1275",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "103771",
        "trust": 2.1
      },
      {
        "db": "SECTRACK",
        "id": "1041301",
        "trust": 1.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-122740",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1275",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "149847",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "147489",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "db": "BID",
        "id": "103771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "id": "VAR-201804-1673",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T19:28:23.339000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CVE-2018-1275: Address partial fix for CVE-2018-1270",
        "trust": 0.8,
        "url": "https://pivotal.io/security/cve-2018-1275"
      },
      {
        "title": "Pivotal Spring Framework Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83325"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2019/01/18/new_oracle_bugs/"
      },
      {
        "title": "Red Hat: Critical: Red Hat FIS 2.0 on Fuse 6.3.0 R8 security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182939 - Security Advisory"
      },
      {
        "title": "Red Hat: CVE-2018-1275",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2018-1275"
      },
      {
        "title": "Debian CVElist Bug Report Logs: libspring-java: CVE-2018-1270 CVE-2018-1272",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=cf592ea3b0a1913a29c923afe44cd4b7"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=81c63752a6f26433af2128b2e8c02385"
      },
      {
        "title": "IBM: Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3dea47d76eee003a50f853f241578c37"
      },
      {
        "title": "PPPRASP\n0x00 Start\n0x01 \u57fa\u672c\u6f0f\u6d1e\u68c0\u6d4b\u7c7b\u578b ing\n0x02 CVE\u6f0f\u6d1e\u68c0\u6d4b",
        "trust": 0.1,
        "url": "https://github.com/Whoopsunix/PPPRASP "
      },
      {
        "title": "https://github.com/bkhablenko/CVE-2017-8046",
        "trust": 0.1,
        "url": "https://github.com/bkhablenko/CVE-2017-8046 "
      },
      {
        "title": "gocarts(go-CERT-alerts-summarizer)\nAbstract\nMain features\nUsage\nFetch JPCERT\nFetch USCERT\nSearch mode\nOutput Mode\nLicense\nAuthor",
        "trust": 0.1,
        "url": "https://github.com/tomoyamachi/gocarts "
      },
      {
        "title": "A2:2017 Broken Authentication\nA5:2017 Broken Access Control\nA3:2017 Sensitive Data Exposure\nA6:2017 Security Misconfiguration\nA9:2017 Using Components with Known Vulnerabilities\nA10:2017 Insufficient Logging \u0026 Monitoring",
        "trust": 0.1,
        "url": "https://github.com/ilmari666/cybsec "
      },
      {
        "title": "Awesome CVE PoC",
        "trust": 0.1,
        "url": "https://github.com/lnick2023/nicenice "
      },
      {
        "title": "Awesome CVE PoC",
        "trust": 0.1,
        "url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
      },
      {
        "title": "Awesome CVE PoC",
        "trust": 0.1,
        "url": "https://github.com/qazbnm456/awesome-cve-poc "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-358",
        "trust": 1.9
      },
      {
        "problemtype": "CWE-94",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "http://www.securityfocus.com/bid/103771"
      },
      {
        "trust": 2.7,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
      },
      {
        "trust": 2.1,
        "url": "https://pivotal.io/security/cve-2018-1275"
      },
      {
        "trust": 2.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      },
      {
        "trust": 2.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:1320"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/errata/rhsa-2018:2939"
      },
      {
        "trust": 1.8,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1041301"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.1,
        "url": "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 1.0,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1275"
      },
      {
        "trust": 0.9,
        "url": "http://pivotal.io/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1275"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.7,
        "url": "https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369@%3cissues.activemq.apache.org%3e"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-guardium-data-encryption-gde-3/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1271"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1305"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1304"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1271"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1304"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-1275"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1305"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/94.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/whoopsunix/ppprasp"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=59022"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-12617"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-12617"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1260"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-7489"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1270"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-7489"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1336"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1270"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/3060411"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html/red_hat_openshift_application_runtimes_release_notes/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=catrhoar.spring.boot\u0026version=1.5.12"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2018-1272"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1272"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "db": "BID",
        "id": "103771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "db": "BID",
        "id": "103771"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-04-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "date": "2018-04-11T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "date": "2018-04-13T00:00:00",
        "db": "BID",
        "id": "103771"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "date": "2018-10-18T03:51:21",
        "db": "PACKETSTORM",
        "id": "149847"
      },
      {
        "date": "2018-05-04T01:11:44",
        "db": "PACKETSTORM",
        "id": "147489"
      },
      {
        "date": "2018-04-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "date": "2018-04-11T13:29:00.353000",
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122740"
      },
      {
        "date": "2023-11-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-1275"
      },
      {
        "date": "2019-07-17T07:00:00",
        "db": "BID",
        "id": "103771"
      },
      {
        "date": "2018-05-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      },
      {
        "date": "2021-10-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      },
      {
        "date": "2024-11-21T03:59:31.333000",
        "db": "NVD",
        "id": "CVE-2018-1275"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Vulnerabilities related to security checks",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003100"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201804-563"
      }
    ],
    "trust": 0.6
  }
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cloudfoundry.org/blog/cve-2023-34061-gorouter-route-pruning/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T20:10:19.266378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:05:36.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Routing Release",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThan": "0.284.0",
              "status": "affected",
              "version": "0.163.0",
              "versionType": "0.284.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CF deployment",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThan": "33.6.0",
              "status": "affected",
              "version": "0.28.0",
              "versionType": "33.6.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-07T14:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.  An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.  An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T07:01:49.532Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.cloudfoundry.org/blog/cve-2023-34061-gorouter-route-pruning/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2023-34061 \u2013 Gorouter route pruning",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34061",
    "datePublished": "2024-01-12T07:01:49.532Z",
    "dateReserved": "2023-05-25T17:21:56.204Z",
    "dateUpdated": "2025-06-03T14:05:36.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:52.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34054"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android",
            "x86",
            "ARM",
            "64 bit",
            "32 bit"
          ],
          "product": "Reactor Netty",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.1.13",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "1.1.13"
            },
            {
              "lessThan": "1.0.39",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "1.0.39"
            },
            {
              "status": "affected",
              "version": "older unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "\nIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T08:16:57.848Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34054"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Reactor Netty HTTP Server Metrics DoS Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34054",
    "datePublished": "2023-11-28T08:16:14.361Z",
    "dateReserved": "2023-05-25T17:21:56.203Z",
    "dateUpdated": "2024-08-02T16:01:52.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.535Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34062"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:reactor_netty:reactor_netty:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "reactor_netty",
            "vendor": "reactor_netty",
            "versions": [
              {
                "lessThan": "1.1.13",
                "status": "affected",
                "version": "1.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T17:43:14.420583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T17:47:11.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Reactor Netty",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "1.1.13",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.39",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "older unsupported versions"
            }
          ]
        }
      ],
      "datePublic": "2023-11-15T09:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory Traversal ",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-15T09:46:42.975Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34062"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34062",
    "datePublished": "2023-11-15T09:46:42.975Z",
    "dateReserved": "2023-05-25T17:21:56.204Z",
    "dateUpdated": "2024-08-29T17:47:11.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:21:33.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-20885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-16T20:04:33.907955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-16T20:05:19.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": " Notifications",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 63"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SMB-volume release",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 3.1.19"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "cf-nfs-volume release",
          "vendor": "Cloud FOundry",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.x versions prior to 5.0.27"
            },
            {
              "status": "affected",
              "version": "7.1.x versions prior to 7.1.19"
            }
          ]
        }
      ],
      "datePublic": "2023-06-15T14:58:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.\u003cp\u003eThis issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-16T12:19:17.758Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CF workflows leak credentials in system audit logs",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-20885",
    "datePublished": "2023-06-16T12:18:35.886Z",
    "dateReserved": "2022-11-01T15:41:50.393Z",
    "dateUpdated": "2024-12-16T20:05:19.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2022-31684"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-31684",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-09T14:28:00.968587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T14:29:04.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Reactor Netty",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Reactor Netty 1.0.11 to 1.0.23"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "HTTP Server may log request headers",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-19T00:00:00.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://tanzu.vmware.com/security/cve-2022-31684"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-31684",
    "datePublished": "2022-10-19T00:00:00.000Z",
    "dateReserved": "2022-05-25T00:00:00.000Z",
    "dateUpdated": "2025-05-09T14:29:04.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:28:42.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2022-22969"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Security OAuth",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "\u003caffected versions\u003e Spring Security OAuth 2.5.x prior to 2.5.2 and older unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u003cIssue Description\u003e Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service (DoS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:47:21.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2022-22969"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2022-22969",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Security OAuth",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003caffected versions\u003e Spring Security OAuth 2.5.x prior to 2.5.2 and older unsupported versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "\u003cIssue Description\u003e Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service (DoS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2022-22969",
              "refsource": "MISC",
              "url": "https://tanzu.vmware.com/security/cve-2022-22969"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-22969",
    "datePublished": "2022-04-21T18:16:02.000Z",
    "dateReserved": "2022-01-10T00:00:00.000Z",
    "dateUpdated": "2024-08-03T03:28:42.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2020-5409"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Concourse",
          "vendor": "Pivotal",
          "versions": [
            {
              "lessThan": "5.2.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.10",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-05-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user\u0027s access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: Open Redirect",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-13T23:15:17.000Z",
        "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
        "shortName": "pivotal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2020-5409"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Concourse Open Redirect in the /sky/login endpoint",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@pivotal.io",
          "DATE_PUBLIC": "2020-05-13T20:52:58.000Z",
          "ID": "CVE-2020-5409",
          "STATE": "PUBLIC",
          "TITLE": "Concourse Open Redirect in the /sky/login endpoint"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Concourse",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.8"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.5.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.8.1"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Pivotal"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user\u0027s access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601: Open Redirect"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2020-5409",
              "refsource": "CONFIRM",
              "url": "https://tanzu.vmware.com/security/cve-2020-5409"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
    "assignerShortName": "pivotal",
    "cveId": "CVE-2020-5409",
    "datePublished": "2020-05-13T23:15:17.452Z",
    "dateReserved": "2020-01-03T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:47:32.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:23.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2020-5406"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Tanzu Application Service for VMs",
          "vendor": "Pivotal",
          "versions": [
            {
              "lessThan": "2.8.5",
              "status": "affected",
              "version": "2.8.x",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.11",
              "status": "affected",
              "version": "2.7.x",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.18",
              "status": "affected",
              "version": "2.6.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-04-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-10T18:50:12.000Z",
        "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
        "shortName": "pivotal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2020-5406"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PCF Autoscaling logs its database credentials",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@pivotal.io",
          "DATE_PUBLIC": "2020-04-09T19:33:58.000Z",
          "ID": "CVE-2020-5406",
          "STATE": "PUBLIC",
          "TITLE": "PCF Autoscaling logs its database credentials"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Tanzu Application Service for VMs",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "2.8.x",
                            "version_value": "2.8.5"
                          },
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "2.7.x",
                            "version_value": "2.7.11"
                          },
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "2.6.x",
                            "version_value": "2.6.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Pivotal"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling."
            }
          ]
        },
        "impact": null,
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-522: Insufficiently Protected Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2020-5406",
              "refsource": "CONFIRM",
              "url": "https://tanzu.vmware.com/security/cve-2020-5406"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
    "assignerShortName": "pivotal",
    "cveId": "CVE-2020-5406",
    "datePublished": "2020-04-10T18:50:12.090Z",
    "dateReserved": "2020-01-03T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:17:26.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cloudfoundry.org/blog/cve-2023-34061-gorouter-route-pruning/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T20:10:19.266378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T14:05:36.784Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Routing Release",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThan": "0.284.0",
              "status": "affected",
              "version": "0.163.0",
              "versionType": "0.284.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CF deployment",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "lessThan": "33.6.0",
              "status": "affected",
              "version": "0.28.0",
              "versionType": "33.6.0"
            }
          ]
        }
      ],
      "datePublic": "2023-12-07T14:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.  An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.  An unauthenticated attacker can use this vulnerability to force route pruning and therefore degrade the service availability of the Cloud Foundry deployment.\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-12T07:01:49.532Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.cloudfoundry.org/blog/cve-2023-34061-gorouter-route-pruning/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2023-34061 \u2013 Gorouter route pruning",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34061",
    "datePublished": "2024-01-12T07:01:49.532Z",
    "dateReserved": "2023-05-25T17:21:56.204Z",
    "dateUpdated": "2025-06-03T14:05:36.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:52.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34054"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "iOS",
            "Android",
            "x86",
            "ARM",
            "64 bit",
            "32 bit"
          ],
          "product": "Reactor Netty",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "1.1.13",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "1.1.13"
            },
            {
              "lessThan": "1.0.39",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "1.0.39"
            },
            {
              "status": "affected",
              "version": "older unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "\nIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T08:16:57.848Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34054"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Reactor Netty HTTP Server Metrics DoS Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34054",
    "datePublished": "2023-11-28T08:16:14.361Z",
    "dateReserved": "2023-05-25T17:21:56.203Z",
    "dateUpdated": "2024-08-02T16:01:52.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.535Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://spring.io/security/cve-2023-34062"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:reactor_netty:reactor_netty:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "reactor_netty",
            "vendor": "reactor_netty",
            "versions": [
              {
                "lessThan": "1.1.13",
                "status": "affected",
                "version": "1.10",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-29T17:43:14.420583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T17:47:11.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Reactor Netty",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "1.1.13",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.39",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "older unsupported versions"
            }
          ]
        }
      ],
      "datePublic": "2023-11-15T09:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\u003c/p\u003e\u003cp\u003eSpecifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.\n\nSpecifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory Traversal ",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-15T09:46:42.975Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2023-34062"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-34062",
    "datePublished": "2023-11-15T09:46:42.975Z",
    "dateReserved": "2023-05-25T17:21:56.204Z",
    "dateUpdated": "2024-08-29T17:47:11.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:21:33.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-20885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-16T20:04:33.907955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-16T20:05:19.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": " Notifications",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 63"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SMB-volume release",
          "vendor": "Cloud Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 3.1.19"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "cf-nfs-volume release",
          "vendor": "Cloud FOundry",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.x versions prior to 5.0.27"
            },
            {
              "status": "affected",
              "version": "7.1.x versions prior to 7.1.19"
            }
          ]
        }
      ],
      "datePublic": "2023-06-15T14:58:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.\u003cp\u003eThis issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-16T12:19:17.758Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CF workflows leak credentials in system audit logs",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2023-20885",
    "datePublished": "2023-06-16T12:18:35.886Z",
    "dateReserved": "2022-11-01T15:41:50.393Z",
    "dateUpdated": "2024-12-16T20:05:19.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2022-31684"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-31684",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-09T14:28:00.968587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-532",
                "description": "CWE-532 Insertion of Sensitive Information into Log File",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T14:29:04.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Reactor Netty",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Reactor Netty 1.0.11 to 1.0.23"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "HTTP Server may log request headers",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-19T00:00:00.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://tanzu.vmware.com/security/cve-2022-31684"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-31684",
    "datePublished": "2022-10-19T00:00:00.000Z",
    "dateReserved": "2022-05-25T00:00:00.000Z",
    "dateUpdated": "2025-05-09T14:29:04.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:28:42.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2022-22969"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Spring Security OAuth",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "\u003caffected versions\u003e Spring Security OAuth 2.5.x prior to 2.5.2 and older unsupported versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u003cIssue Description\u003e Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service (DoS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:47:21.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2022-22969"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2022-22969",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Spring Security OAuth",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003caffected versions\u003e Spring Security OAuth 2.5.x prior to 2.5.2 and older unsupported versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "\u003cIssue Description\u003e Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service (DoS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2022-22969",
              "refsource": "MISC",
              "url": "https://tanzu.vmware.com/security/cve-2022-22969"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2022-22969",
    "datePublished": "2022-04-21T18:16:02.000Z",
    "dateReserved": "2022-01-10T00:00:00.000Z",
    "dateUpdated": "2024-08-03T03:28:42.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:24.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2020-5409"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Concourse",
          "vendor": "Pivotal",
          "versions": [
            {
              "lessThan": "5.2.8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.10",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-05-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user\u0027s access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: Open Redirect",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-13T23:15:17.000Z",
        "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
        "shortName": "pivotal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2020-5409"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Concourse Open Redirect in the /sky/login endpoint",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@pivotal.io",
          "DATE_PUBLIC": "2020-05-13T20:52:58.000Z",
          "ID": "CVE-2020-5409",
          "STATE": "PUBLIC",
          "TITLE": "Concourse Open Redirect in the /sky/login endpoint"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Concourse",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.8"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.5.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.8.1"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "6.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Pivotal"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user\u0027s access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601: Open Redirect"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2020-5409",
              "refsource": "CONFIRM",
              "url": "https://tanzu.vmware.com/security/cve-2020-5409"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
    "assignerShortName": "pivotal",
    "cveId": "CVE-2020-5409",
    "datePublished": "2020-05-13T23:15:17.452Z",
    "dateReserved": "2020-01-03T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:47:32.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:23.971Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tanzu.vmware.com/security/cve-2020-5406"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Tanzu Application Service for VMs",
          "vendor": "Pivotal",
          "versions": [
            {
              "lessThan": "2.8.5",
              "status": "affected",
              "version": "2.8.x",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.11",
              "status": "affected",
              "version": "2.7.x",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.18",
              "status": "affected",
              "version": "2.6.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-04-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-10T18:50:12.000Z",
        "orgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
        "shortName": "pivotal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tanzu.vmware.com/security/cve-2020-5406"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PCF Autoscaling logs its database credentials",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@pivotal.io",
          "DATE_PUBLIC": "2020-04-09T19:33:58.000Z",
          "ID": "CVE-2020-5406",
          "STATE": "PUBLIC",
          "TITLE": "PCF Autoscaling logs its database credentials"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Tanzu Application Service for VMs",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "2.8.x",
                            "version_value": "2.8.5"
                          },
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "2.7.x",
                            "version_value": "2.7.11"
                          },
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "2.6.x",
                            "version_value": "2.6.18"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Pivotal"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x versions prior to 2.8.5, includes a version of PCF Autoscaling that writes database connection properties to its log, including database username and password. A malicious user with access to those logs may gain unauthorized access to the database being used by Autoscaling."
            }
          ]
        },
        "impact": null,
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-522: Insufficiently Protected Credentials"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tanzu.vmware.com/security/cve-2020-5406",
              "refsource": "CONFIRM",
              "url": "https://tanzu.vmware.com/security/cve-2020-5406"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "862b2186-222f-48b9-af87-f1fb7bb26d03",
    "assignerShortName": "pivotal",
    "cveId": "CVE-2020-5406",
    "datePublished": "2020-04-10T18:50:12.090Z",
    "dateReserved": "2020-01-03T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:17:26.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}