Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2020-7663

rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Satellite and 2 more
CVE-2020-7238

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Netty and 1 more
Products
Debian Linux Fedora Netty and 17 more
CVE-2020-5267

Possible XSS vulnerability in ActionView

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

CVSS 3.1 · 4 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Leap and 3 more
CVE-2020-5217

Directive injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

CVSS 3.1 · 4.4 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Twitter
Products
Satellite Satellite Capsule Secure Headers
CVE-2020-5216

Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline. This has been fixed in 6.3.0, 5.2.0, and 3.9.0.

CVSS 3.1 · 4.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Twitter
Products
Satellite Satellite Capsule Secure Headers
CVE-2020-26247

XXE in Nokogiri

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

CVSS 3.1 · 2.6 Low EPSS 1.2% KEV · Not listed
Vendors
Debian Nokogiri Redhat
Products
Debian Linux Nokogiri 3scale Amp and 2 more
CVE-2020-25633

resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2020-15169

XSS in Action View

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

CVSS 3.1 · 5.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Action View Project Debian Fedoraproject and 1 more
Products
Action View Debian Linux Fedora and 2 more
CVE-2020-14380

Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover

An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2020-14371

Satellite: Compute resource credential leak

A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are running on these resources in Satellite.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite
CVE-2020-14343

PyYAML: incomplete fix for CVE-2020-1747

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

CVSS 3.1 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Oracle Pyyaml Redhat
Products
Communications Cloud Native Core Network Function Cloud Native Environment Pyyaml Enterprise Linux and 2 more
CVE-2020-14335

foreman: world-readable OMAPI secret through the ISC DHCP server

A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2020-14334

foreman: unauthorized cache read on RPM-based installations through local user

A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to gain complete control of the Satellite instance.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2020-11612

netty: compression/decompression codecs don't enforce limits on buffer allocation sizes

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Oncommand Api Services and 23 more
CVE-2020-10716

rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman Ansible
CVE-2020-10710

foreman-installer: Candlepin plaintext password disclosure while Satellite update

A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2020-10693

hibernate-validator: Improper input validation in the interpolation of constraint error messages

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.

CVSS 3.1 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Ibm Oracle Quarkus and 1 more
Products
Websphere Application Server Weblogic Server Quarkus and 10 more
CVE-2019-3893

foreman: Recover of plaintext password or token for the compute resources

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman
CVE-2019-3891

candlepin: credentials exposure through log files

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching package updates, thus preventing all Satellite hosts from accessing those updates.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule
CVE-2019-3845

katello-installer-base: QMF methods exposed to goferd via qdrouterd

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Satellite Tools Satellite and 1 more