CVE-2023-4910

3scale-admin-portal: logged out users tokens can be accessed

A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Api Management

CVE-2024-9671

System: pdf invoices of the developer users can be seen if the url is known

A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Api Management Platform

CVE-2026-92925

Redis: redis: out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Pen Drive Powered By Red Hat Lightspeed Red Hat Openshift Ai (rhoai) 3scale and 19 more

CVE-2024-10295

Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request

A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Api Management

CVE-2026-29063

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Immutable-js Redhat

Products

Immutable Immutable-js 3scale Api Management Platform and 25 more

CVE-2026-46625

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Js-cookie Redhat

Products

Javascript Cookie Js-cookie 3scale Api Management and 5 more

CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed

Vendors

Akka Amazon Apache and 30 more

Products

Http Server Opensearch Data Prepper Apisix and 375 more

CVE-2022-1414

3scale-system: script injection in multiple endpoints

3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Api Management

CVE-2017-7512

AMP: validation bypass in oauth

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

CVSS 3.0 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Redhat

Products

3scale Amp 3scale Api Management Platform

CVE-2022-0330

kernel: possible privileges escalation due to missing TLB flush

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 1 more

Products

Fedora Linux Kernel H300e and 49 more

CVE-2021-3656

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel 3scale Api Management and 28 more

CVE-2021-3609

kernel: race condition in net/can/bcm.c leads to local privilege escalation

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300e H300e Firmware and 43 more

CVE-2021-3412

3scale: lack of brute force protection on dev portal login

It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Api Management

CVE-2021-20252

3scale: missing date range handling on database query

A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Api Management

CVE-2020-25634

3scale-system: API docs accessible without permissions

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Api Management

CVE-2020-14388

3scale-system: member role permissions bypass when editing services

A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Api Management

CVE-2019-14852

apicast: deprecated protocol TLS 1.0 enabled in gateway

A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Api Management

CVE-2019-10216

ghostscript: -dSAFER escape via .buildfont1 (701394)

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript 3scale Amp 3scale Api Management and 7 more