Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 263

Export CSV
CVE-2023-4380

Platform: token exposed at importing project

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 3 more
CVE-2024-10033

Aap-gateway: xss on aap-gateway

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 3 more
CVE-2023-5189

Hub: insecure galaxy-importer tarfile extraction

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 4 more
CVE-2023-5115

Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

CVSS 3.1 · 6.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Automation Platform Ansible Automation Platform Developer and 4 more
CVE-2024-0690

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ansible Ansible Automation Platform and 5 more
CVE-2024-3651

Denial of Service via Quadratic Complexity in kjd/idna

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Kjd Redhat
Products
Internationalized Domain Names In Applications Ansible Automation Platform Enterprise Linux and 5 more
CVE-2024-27351

python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2024-24680

Django: denial-of-service in ``intcomma`` template filter

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2023-43665

python-django: Denial-of-service possibility in django.utils.text.Truncator

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Ansible Automation Platform and 3 more
CVE-2023-41164

python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Ansible Automation Platform and 3 more
CVE-2023-36053

python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 5 more
CVE-2023-29483

dnspython: denial of service in stub resolver

eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.

CVSS 3.1 · 7 High EPSS 1.9% KEV · Not listed
Vendors
Dnspython Eventlet Fedoraproject and 2 more
Products
Dnspython Eventlet Fedora and 6 more
CVE-2024-42005

python-django: Potential SQL injection in QuerySet.values() and values_list()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 3 more
CVE-2024-41991

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 3 more
CVE-2024-41990

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Rhui
CVE-2024-41989

python-django: Memory exhaustion in django.utils.numberformat.floatformat()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 1 more
CVE-2024-39614

python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

CVSS 3.1 · 7.5 High EPSS 28.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2024-39330

python-django: Potential directory-traversal in django.core.files.storage.Storage.save()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more