Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2016-0264

JDK: buffer overflow vulnerability in the IBM JVM

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 5.6 Medium EPSS 3.9% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Sdk Enterprise Linux Desktop Enterprise Linux Hpc Node Supplementary and 12 more
CVE-2015-1609

mongodb: DoS due to improper BSON validation

MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Mongodb Redhat
Products
Fedora Mongodb Satellite and 1 more
CVE-2014-3654

Satellite: Spacewalk contains multiple XSS (stored and reflected)

Multiple cross-site scripting (XSS) vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) kickstart/cobbler/CustomSnippetList.do, (2) channels/software/Entitlements.do, or (3) admin/multiorg/OrgUsers.do.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Suse
Products
Network Satellite Satellite Satellite With Embedded Oracle and 4 more
CVE-2013-4346

python-oauth2: _check_signature() ignores the nonce value when validating signed urls

The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Urbanairship
Products
Satellite Satellite Capsule Python-oauth2
CVE-2014-3653

foreman: cross-site scripting (XSS) flaw in template preview screen

Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2014-3595

Satellite: Spacewalk contains XSS in log file view

Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Suse
Products
Network Satellite Satellite Satellite With Embedded Oracle and 4 more
CVE-2015-7518

foreman: Stored XSS vulnerability in smart class parameters/variables

Multiple cross-site scripting (XSS) vulnerabilities in information popups in Foreman before 1.10.0 allow remote attackers to inject arbitrary web script or HTML via (1) global parameters, (2) smart class parameters, or (3) smart variables in the (a) host or (b) hostgroup edit forms.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2015-5233

foreman: reports show/destroy not restricted by host authorization

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.

CVSS 3.0 · 4.2 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2014-1704

v8: multiple vulnerabilities fixed in Google Chrome version 33.0.1750.149

Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 10.0 Critical EPSS 1.5% KEV · Not listed
Vendors
Google Redhat
Products
Chrome V8 Rhel Software Collections and 2 more
CVE-2015-5041

JDK: J9 JVM allows code to invoke non-public interface methods

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.

CVSS 3.0 · 9.1 Critical EPSS 3.9% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Sdk Websphere Application Server Network Satellite and 5 more
CVE-2015-5006

JDK: local disclosure of kerberos credentials cache

IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3 FP20, 7 before SR9 FP20, 6 R1 before SR8 FP15, and 6 before SR16 FP15 allow physically proximate attackers to obtain sensitive information by reading the Kerberos Credential Cache.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java 2 Sdk Java Sdk Enterprise Linux Desktop and 8 more
CVE-2014-0192

Foreman: provisioning templates are world accessible

Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."

CVSS 2.0 · 5.0 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Foreman
CVE-2014-0090

Foreman: Session fixation

Session fixation vulnerability in Foreman before 1.4.2 allows remote attackers to hijack web sessions via the session id cookie.

CVSS 2.0 · 6.8 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Foreman
CVE-2014-0135

rubygem-kafo: temporary file creation vulnerability when creating /tmp/default_values.yaml

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Kafo
CVE-2013-4347

python-oauth2: Uses poor PRNG in nonce

The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.

CVSS 2.0 · 5.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Urbanairship
Products
Satellite Satellite Capsule Python-oauth2
CVE-2013-1871

Satellite/Spacewalk: XSS in EditAddress page

Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVSS 2.0 · 3.5 Low EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2010-1171

rhn_satellite: Improper channel comps information management

Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels.

CVSS 2.0 · 5.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2012-1145

satellite: remote package upload without authorization

spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Network Satellite Satellite
CVE-2012-1717

OpenJDK: insecure temporary file permissions (JRE, 7143606)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Oracle Redhat and 2 more
Products
Linux Kernel Jdk Jre and 20 more