Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 131

Export CSV
CVE-2019-3869

Tower: credentials leaked through environment variables

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Managementengine
CVE-2019-14905

Ansible: malicious code could craft filename in nxos_file_copy module

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Backports Sle Leap and 5 more
CVE-2019-14894

CloudForms: RCE vulnerability in NFS schedule backup

A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.

CVSS 3.1 · 8 High EPSS 4.1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Management Engine Cloudforms Managementengine
CVE-2019-14864

Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Backports Sle Leap and 6 more
CVE-2019-11358

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVSS 3.1 · 6.1 Medium EPSS 86.8% KEV · Not listed
Vendors
Backdropcms Debian Drupal and 8 more
Products
Backdrop Debian Linux Drupal and 111 more
CVE-2019-10177

CloudForms: Store XSS in PDF exports feature allows code execution of Javascript and HTML input

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Management Engine
CVE-2019-10159

cfme: Improper authorization in migration log controller allows any user to access VM migration logs

cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cfme-gemset Cloudforms Cloudforms Managementengine
CVE-2019-0223

qpid-proton: TLS Man in the Middle Vulnerability

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.

CVSS 3.1 · 7.4 High EPSS 6.2% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid A Mq Clients Cloudforms Managementengine and 14 more
CVE-2018-7750

python-paramiko: Authentication bypass in transport.py

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Debian Paramiko Redhat
Products
Debian Linux Paramiko Ansible Engine and 15 more
CVE-2018-3760

rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

CVSS 3.0 · 7.5 High EPSS 26.3% KEV · Not listed
Vendors
Debian Redhat Sprockets Project
Products
Debian Linux Cloudforms Cloudforms Managementengine and 3 more
CVE-2018-3741

rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Html Sanitizer
CVE-2018-1104

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Cloudforms Managementengine
CVE-2018-1101

ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.

CVSS 3.0 · 7.2 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Cloudforms Managementengine
CVE-2018-1058

postgresql: Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

CVSS 3.1 · 8.8 High EPSS 13.1% KEV · Not listed
Vendors
Canonical Postgresql Redhat
Products
Ubuntu Linux Postgresql Cloudforms and 2 more
CVE-2018-1053

postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 3 more
CVE-2018-16476

activejob: Information Exposure through deserialization using GlobalId

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Cloudforms Managementengine Rails
CVE-2018-10925

postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.

CVSS 3.1 · 8.1 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more