Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2021-29509

Keepalive Connections Causing Denial Of Service in puma

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Debian Puma Redhat
Products
Debian Linux Puma Satellite
CVE-2021-28658

django: potential directory-traversal via uploaded files

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 3 more
CVE-2021-27025

puppet: silent configuration failure in agent

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Puppet Redhat
Products
Fedora Puppet Puppet Agent and 5 more
CVE-2021-22904

rails: Possible DoS Vulnerability in Action Controller Token Authentication

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Satellite Rails
CVE-2021-22902

rails: Possible Denial of Service vulnerability in Action Dispatch

The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Satellite Rails
CVE-2021-22885

rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Debian Redhat Rubyonrails
Products
Debian Linux Satellite Actionpack Page-caching and 1 more
CVE-2021-21330

Open redirect vulnerability in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.

CVSS 3.1 · 3.1 Low EPSS 1.9% KEV · Not listed
Vendors
Aiohttp Debian Fedoraproject and 1 more
Products
Aiohttp Debian Linux Fedora and 2 more
CVE-2021-20256

Satellite: BMC controller credential leak via API

A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2020-9402

django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

CVSS 3.1 · 8.8 High EPSS 24.0% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 3 more
Products
Ubuntu Linux Debian Linux Django and 4 more
CVE-2020-8185

rubygem-rails: untrusted users able to run pending migrations in production

A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Redhat Rubyonrails
Products
Fedora Satellite Rails
CVE-2020-8184

rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Rack Project and 1 more
Products
Ubuntu Linux Debian Linux Rack and 2 more
CVE-2020-8164

rubygem-actionpack: possible strong parameters bypass

A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Backports Sle Leap and 3 more
CVE-2020-8162

rubygem-activestorage: circumvention of file size limits in ActiveStorage

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Debian Redhat Rubyonrails
Products
Debian Linux Satellite Satellite Capsule and 1 more
CVE-2020-8161

rubygem-rack: directory traversal in Rack::Directory

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

CVSS 3.1 · 8.6 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Rack Project and 1 more
Products
Ubuntu Linux Debian Linux Rack and 2 more
CVE-2020-8130

rake: OS Command Injection via egrep in Rake::FileList

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2020-7943

puppet: puppet server and puppetDB may leak sensitive information via metrics API

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

CVSS 3.1 · 7.5 High EPSS 7.7% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Enterprise Puppet Server Puppetdb and 2 more
CVE-2020-7942

puppet: Arbitrary catalog retrieval

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Puppet Agent Satellite and 1 more