Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2024-4812

Katello: potential cross-site scripting exploit in ui

A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Katello Project Redhat
Products
Katello Satellite
CVE-2023-4320

Satellite: arithmetic overflow in satellite

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule Satellite Maintenance and 1 more
CVE-2023-5189

Hub: insecure galaxy-importer tarfile extraction

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 4 more
CVE-2024-7923

Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Rhui Satellite Satellite Capsule and 2 more
CVE-2024-7012

Puppet-foreman: an authentication bypass vulnerability exists in foreman

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule Satellite Maintenance and 1 more
CVE-2024-27351

python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2024-24680

Django: denial-of-service in ``intcomma`` template filter

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2023-43665

python-django: Denial-of-service possibility in django.utils.text.Truncator

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Ansible Automation Platform and 3 more
CVE-2023-41164

python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Ansible Automation Platform and 3 more
CVE-2023-36053

python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 5 more
CVE-2024-42005

python-django: Potential SQL injection in QuerySet.values() and values_list()

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 3 more
CVE-2024-41991

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Discovery and 3 more
CVE-2024-39614

python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

CVSS 3.1 · 7.5 High EPSS 28.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 3 more
CVE-2024-39330

python-django: Potential directory-traversal in django.core.files.storage.Storage.save()

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2024-39329

python-django: Username enumeration through timing difference for users with unusable passwords

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2024-38875

python-django: Potential denial-of-service in django.utils.html.urlize()

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Ansible Automation Platform Openstack and 2 more
CVE-2025-27610

Local File Inclusion in Rack::Static

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Rack Redhat
Products
Rack Logging Satellite and 1 more