Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2013-4956

Puppet: Local Privilege Escalation/Arbitrary Code Execution

Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Puppet Puppetlabs Redhat
Products
Puppet Puppet Enterprise Puppet and 1 more
CVE-2013-6044

python-django: xss in is_safe_url function

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Openstack
CVE-2013-6391

Keystone: trust circumvention through EC2-style tokens

The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.

CVSS 2.0 · 5.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Openstack
CVE-2013-6393

libyaml: heap-based buffer overflow when parsing YAML tags

The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 7.4% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 5 more
CVE-2013-6414

rubygem-actionpack: Action View DoS

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

CVSS 2.0 · 5.0 Medium EPSS 20.7% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2013-6415

rubygem-actionpack: number_to_currency XSS

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

CVSS 2.0 · 4.3 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2013-6417

rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

CVSS 2.0 · 6.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Openstack Rhel Software Collections and 2 more
CVE-2013-6419

Nova: Metadata queries from Neutron to Nova are not restricted by tenant

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Openstack Redhat
Products
Havana Openstack
CVE-2013-6426

Heat: CFN policy rules not all enforced

The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.

CVSS 2.0 · 4.0 Medium EPSS 1.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Heat Openstack
CVE-2013-6428

Heat: ReST API doesn't respect tenant scoping

The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.

CVSS 2.0 · 4.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Openstack Redhat
Products
Heat Openstack
CVE-2013-6491

nova: qpid SSL configuration

The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Openstack Redhat
Products
Oslo Openstack
CVE-2013-6858

openstack: horizon multiple XSS vulnerabilities.

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Openstack Opensuse and 1 more
Products
Ubuntu Linux Horizon Opensuse and 1 more
CVE-2013-7048

Nova: insecure directory permissions in snapshots

OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2013-7130

nova: Live migration can leak root disk into ephemeral storage

The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.

CVSS 2.0 · 7.1 High EPSS 2.4% KEV · Not listed
Vendors
Openstack Redhat
Products
Compute Grizzly Havana and 2 more
CVE-2014-0006

Swift: TempURL timing attack

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Openstack Redhat
Products
Swift Openstack
CVE-2014-1948

openstack-glance: Glance Swift store backend password leak

OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.

CVSS 2.0 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2012-4406

Openstack-Swift: insecure use of python pickle()

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

CVSS 3.1 · 9.8 Critical EPSS 6.6% KEV · Not listed
Vendors
Fedoraproject Openstack Redhat
Products
Fedora Swift Enterprise Linux Server and 5 more
CVE-2012-4413

OpenStack-Keystone: role revocation token issues

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

CVSS 2.0 · 4.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack
CVE-2012-4456

2012.1.1: fails to validate tokens in Admin API

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack
CVE-2012-4457

2012.1.1: fails to raise Unauthorized user error for disabled tenant

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Openstack Redhat
Products
Keystone Openstack