Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2013-1793

openstack-utils: openstack-db insecure password creation for services

openstack-utils openstack-db has insecure password creation

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack Essex
CVE-2012-5474

OpenStack: Dashboard /etc/openstack-dashboard/local_settings secret key exposure

The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Openstack and 1 more
Products
Debian Linux Fedora Horizon and 1 more
CVE-2024-49768

Waitress has request processing race condition in HTTP pipelining with invalid first request

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Agendaless Pylons Redhat
Products
Waitress Waitress Openshift Ironic and 1 more
CVE-2024-42353

WebOb's location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pylonsproject Redhat
Products
Webob Ceph Storage Openshift and 2 more