Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 42

Export CSV
CVE-2017-7481

ansible: Security issue with lookup return not tainting the jinja2 environment

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Ansible Engine and 11 more
CVE-2016-8647

Ansible: in some circumstances the mysql_user module may fail to correctly change a password

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.

CVSS 3.1 · 4.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Rhev Manager Virtualization