Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 106

Export CSV
CVE-2019-8322

rubygems: Escape sequence injection vulnerability in gem owner

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8321

rubygems: Escape sequence injection vulnerability in verbose

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8320

rubygems: Delete directory using symlink when decompressing tar

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.

CVSS 3.0 · 7.4 High EPSS 4.2% KEV · Not listed
Vendors
Redhat Rubygems
Products
Cloudforms Managementengine Enterprise Linux Rhel Software Collections and 1 more
CVE-2019-5419

rubygem-actionpack: denial of service vulnerability in Action View

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

CVSS 3.1 · 7.5 High EPSS 8.4% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Leap and 5 more
CVE-2019-3869

Tower: credentials leaked through environment variables

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Managementengine
CVE-2019-14894

CloudForms: RCE vulnerability in NFS schedule backup

A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.

CVSS 3.1 · 8 High EPSS 4.1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Management Engine Cloudforms Managementengine
CVE-2019-11358

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVSS 3.1 · 6.1 Medium EPSS 86.8% KEV · Not listed
Vendors
Backdropcms Debian Drupal and 8 more
Products
Backdrop Debian Linux Drupal and 111 more
CVE-2019-10159

cfme: Improper authorization in migration log controller allows any user to access VM migration logs

cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cfme-gemset Cloudforms Cloudforms Managementengine
CVE-2019-0223

qpid-proton: TLS Man in the Middle Vulnerability

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

CVSS 3.1 · 7.4 High EPSS 6.2% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid A Mq Clients Cloudforms Managementengine and 14 more
CVE-2018-7750

python-paramiko: Authentication bypass in transport.py

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Debian Paramiko Redhat
Products
Debian Linux Paramiko Ansible Engine and 15 more
CVE-2018-3760

rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

CVSS 3.0 · 7.5 High EPSS 26.3% KEV · Not listed
Vendors
Debian Redhat Sprockets Project
Products
Debian Linux Cloudforms Cloudforms Managementengine and 3 more
CVE-2018-3741

rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Html Sanitizer
CVE-2018-1104

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Cloudforms Managementengine
CVE-2018-1101

ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.

CVSS 3.0 · 7.2 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Cloudforms Managementengine
CVE-2018-1058

postgresql: Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

CVSS 3.1 · 8.8 High EPSS 13.1% KEV · Not listed
Vendors
Canonical Postgresql Redhat
Products
Ubuntu Linux Postgresql Cloudforms and 2 more
CVE-2018-1053

postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 3 more
CVE-2018-16476

activejob: Information Exposure through deserialization using GlobalId

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Cloudforms Managementengine Rails