{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-14T21:07:49.171","vulnerabilities":[{"cve":{"id":"CVE-2018-8035","sourceIdentifier":"security@apache.org","published":"2019-05-01T21:29:00.550","lastModified":"2024-11-21T04:13:08.880","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code."},{"lang":"es","value":"Esta vulnerabilidad se relaciona con el procesamiento de los datos de entrada de la página web de DUCC por parte del navegador del usuario. El javascript que contiene Apache UIMA DUCC (versiones anteriores e incluyendo 2.2.2) que se ejecuta en el navegador del usuario no filtra suficientemente las entradas suministradas por el usuario, lo que puede dar lugar a una ejecución no intencionada del código javascript suministrado por el usuario."}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N\/AC:M\/Au:N\/C:N\/I:P\/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:uimaducc:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.2","matchCriteriaId":"15F3BA52-F186-4864-B61F-F180A9350878"}]}]}],"references":[{"url":"http:\/\/www.securityfocus.com\/bid\/108195","source":"security@apache.org"},{"url":"https:\/\/lists.apache.org\/thread.html\/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E","source":"security@apache.org"},{"url":"https:\/\/uima.apache.org\/security_report","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http:\/\/www.securityfocus.com\/bid\/108195","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https:\/\/lists.apache.org\/thread.html\/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https:\/\/uima.apache.org\/security_report","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}