Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 106

Export CSV
CVE-2014-0062

postgresql: CREATE INDEX race condition possibly leading to privilege escalation

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

CVSS 2.0 · 4.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0066

postgresql: NULL pointer dereference

The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-2669

postgresql: multiple integer overflows in hstore_io.c

Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.

CVSS 2.0 · 6.5 Medium EPSS 3.5% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Rhel Software Collections
CVE-2014-0061

postgresql: privilege escalation via procedural language validator functions

The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.

CVSS 2.0 · 6.5 Medium EPSS 4.9% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0180

CFME: app/controllers/application_controller.rb wait_for_task DoS

The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0137

CFME: ReportController SQL injection

SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.

CVSS 2.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0176

CFME: reflected XSS in several places due to missing JavaScript escaping

Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2016-5383

CloudForms: Lack of field filters on user input

The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Cloudforms Managementengine
CVE-2014-0184

CFME: root password is written to evm.log when entered during VM provisioning

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0060

postgresql: SET ROLE without ADMIN OPTION allows adding and removing group members

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

CVSS 2.0 · 4.0 Medium EPSS 4.1% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2013-6417

rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

CVSS 2.0 · 6.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Openstack Rhel Software Collections and 2 more
CVE-2014-0082

rubygem-actionpack: Action View string handling denial of service

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.

CVSS 2.0 · 5.0 Medium EPSS 6.2% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Rhel Software Collections Rails and 1 more
CVE-2014-0081

rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.

CVSS 2.0 · 4.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Opensuse Opensuse Project Redhat and 1 more
Products
Opensuse Opensuse Cloudforms and 5 more
CVE-2013-4492

rubygem-i18n: cross-site scripting flaw in exception handling

Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
I18n Project Redhat
Products
I18n Cloudforms Managementengine
CVE-2013-1901

postgresql: Improper user privilege check for on-line backups

PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.

CVSS 2.0 · 4.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Postgresql Redhat
Products
Ubuntu Linux Postgresql Cloudforms Managementengine