Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 329

Export CSV
CVE-2020-8165

rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

CVSS 3.1 · 9.8 Critical EPSS 45.7% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Satellite and 2 more
CVE-2016-1000338

bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Bouncycastle Canonical Netapp and 1 more
Products
Legion-of-the-bouncy-castle-java-crytography-api Ubuntu Linux 7-mode Transition Tool and 3 more
CVE-2016-4996

foreman: inside discovery-debug, the root password is displayed in plaintext

discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Server Satellite Satellite Capsule
CVE-2015-1820

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses

REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

CVSS 3.0 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Redhat Rest-client Project
Products
Cloudforms Managementengine Satellite Satellite Capsule and 1 more
CVE-2016-3112

pulp: Agent certificate containing private key is stored in world-readable file

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and authenticating as a consumer user.

CVSS 3.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Pulp Satellite Satellite Capsule
CVE-2016-3111

pulp: Race condition when generating RSA keys for authenticating messages between server and consumers

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Pulp Satellite Satellite Capsule
CVE-2016-3108

pulp: Insecure temporary file used when generating certificate for Pulp Nodes

The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Pulp Satellite Satellite Capsule
CVE-2016-3107

pulp: Node certificate containing private key stored in world-readable file

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Pulp Satellite Satellite Capsule
CVE-2015-0224

qpid-cpp: AMQP 0-10 protocol sequence-set maximal range DoS (incomplete CVE-2015-0203 fix)

qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203.

CVSS 3.0 · 7.5 High EPSS 15.1% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Enterprise Mrg Satellite and 1 more
CVE-2016-10516

python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.

CVSS 3.0 · 6.1 Medium EPSS 2.0% KEV · Not listed
Vendors
Palletsprojects Redhat
Products
Werkzeug Satellite Satellite Capsule
CVE-2017-7233

python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

CVSS 3.0 · 6.1 Medium EPSS 2.4% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Openstack Satellite and 1 more
CVE-2017-5929

logback: Serialization vulnerability in SocketServer and ServerSocketReceiver

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Jboss Amq Jboss Bpms and 4 more
CVE-2014-4616

python: missing boundary check in JSON module

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

CVSS 3.1 · 5.9 Medium EPSS 7.8% KEV · Not listed
Vendors
Opensuse Opensuse Project Python and 2 more
Products
Opensuse Opensuse Python and 5 more
CVE-2017-2295

puppet: Unsafe YAML deserialization

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

CVSS 3.0 · 8.2 High EPSS 2.8% KEV · Not listed
Vendors
Debian Puppet Redhat
Products
Debian Linux Puppet Satellite and 1 more
CVE-2017-15100

foreman: Stored XSS in fact name or value

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button and hovering over the chart; (2) Trends page, when checking the graph for a trend based on a such fact; (3) Statistics page, for facts that are aggregated on this page.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Foreman