CVE-2016-2142

openshift: Bind password for AD account is stored in world readable file

Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by reading the file.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2016-4036

quagga: Wrong permissions allowing information leak

The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse

Products

Leap Opensuse

CVE-2016-4971

wget: Lack of filename checking allows arbitrary file upload via FTP redirect

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

CVSS 3.1 · 8.8 High EPSS 46.1% KEV · Not listed

Vendors

Canonical Gnu Oracle and 2 more

Products

Ubuntu Linux Wget Solaris and 2 more

CVE-2016-6322

QCI: creates world readable /etc/qci/answers contains sensitive password

Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for /etc/qci/answers, which allows local users to obtain the root password for the deployed system by reading the file.

CVSS 3.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Quickstart Cloud Installer

CVE-2016-6494

mongodb: world-readable .dbshell history file

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Mongodb

Products

Fedora Mongodb

CVE-2013-2027

Jython creates executables class files with wrong permissions

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Jython Project Opensuse

Products

Jython Opensuse

CVE-2016-6662

mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

CVSS 3.0 · 9.8 Critical EPSS 67.7% KEV · Not listed

Vendors

Debian Mariadb Oracle and 2 more

Products

Debian Linux Mariadb Mysql and 10 more

CVE-2014-0164

mcollective: world readable client config

openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2014-0200

ovirt-engine-reports: js-jboss7-ds.xml is world-readable

The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasource configuration file (js-jboss7-ds.xml), which allows local users to obtain sensitive information by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Rhev Manager Rhevm-reports

CVE-2014-0199

ovirt-engine-reports: setup script logs database password in cleartext

The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Rhev Manager Rhevm-reports

CVE-2014-1875

perl-Capture-Tiny: insecure temporary file usage

The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Cspan

Products

Capture-tiny

CVE-2014-2068

jenkins: information leak via system diagnostic functionalities (SECURITY-73)

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump.

CVSS 2.0 · 3.5 Low EPSS 1.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2014-3209

ldns: ldns-keygen generates keys with world readable permissions

The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Nlnetlabs

Products

Ldns

CVE-2016-0823

kernel: Leakage of physical address mappings to non-privileged userspace

The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.

CVSS 3.0 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

Google Linux

Products

Android Linux Kernel

CVE-2014-9447

elfutils: directory traversal in read_long_names()

Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.

CVSS 2.0 · 6.4 Medium EPSS 5.0% KEV · Not listed

Vendors

Elfutils Project Redhat

Products

Elfutils Enterprise Linux

CVE-2015-0237

vdsm: Users attempting a live storage migration create snapshot without snapshot creation permissions

Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Redhat

Products

Enterprise Virtualization Manager Rhev Manager

CVE-2015-0257

ovirt-engine-dwh: incorrect permissions on plugin file containing passwords

Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Virtualization Manager Rhev Manager

CVE-2015-0271

dashboard: log file arbitrary file retrieval

The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path.

CVSS 2.0 · 4.0 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Openstack

CVE-2015-3201

thermostat: world-readable configuration file containing credentials

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Rhel Software Collections Thermostat

CVE-2015-8660

kernel: Permission bypass on overlayfs during copy_up

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

CVSS 3.1 · 6.7 Medium EPSS 22.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more