Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 13

Export CSV
CVE-2012-5561

Katello: /etc/katello/secure/passphrase is world readable

script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Katello Rhel Sam
Products
1 Katello 1.2
CVE-2012-5603

Katello: lack of authorization in proxies_controller.rb

proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system.

CVSS 2.0 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Cloudforms Tools Redhat Rhel Sam
Products
1 Cloudforms 1.2
CVE-2012-6109

rubygem-rack: parsing Content-Disposition header DoS

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Cloudforms Cloudengine Rack Project Rhel Sam
Products
1 Rack 1.2
CVE-2012-6116

Candlepin: bootstrap RPM deploys CA certificate file with mode 666

modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Katello Rhel Sam
Products
1 Katello Katello-configure and 1 more
CVE-2013-0162

rubygem-ruby_parser: incorrect temporary file usage

The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.2 and 1 more
CVE-2013-0183

rubygem-rack: receiving excessively long lines triggers out-of-memory error

multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Cloudforms Cloudengine Rack Project Rhel Sam
Products
1 Rack 1.2
CVE-2013-0184

rubygem-rack: Rack::Auth:: AbstractRequest DoS

Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Cloudforms Cloudengine Rack Project Rhel Sam
Products
1 Rack 1.2
CVE-2013-0256

rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Cloudforms Cloudengine Redhat and 2 more
Products
Ubuntu Linux 1 Openshift and 3 more
CVE-2013-0263

rubygem-rack: Timing attack in cookie sessions

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

CVSS 2.0 · 5.1 Medium EPSS 5.4% KEV · Not listed
Vendors
Rack Project Redhat Rhel Sam
Products
Rack Openshift 1.2
CVE-2013-0269

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

CVSS 2.0 · 7.5 High EPSS 13.9% KEV · Not listed
Vendors
Redhat Rhel Sam Rubygems
Products
Fuse Esb Enterprise Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2013-0276

rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openshift 1.2 Rails
CVE-2013-1823

Katello: Notifications page Username XSS

Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Rhel Sam
Products
Subscription Asset Manager 1.2