Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 106

Export CSV
CVE-2019-12439

bubblewrap: temporary directory misuse as mount point

bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.

CVSS 3.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Projectatomic Redhat
Products
Bubblewrap Cloudforms Managementengine
CVE-2014-0130

rubygem-actionpack: directory traversal issue

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

CVSS 3.1 · 7.5 High EPSS 53.7% KEV · Listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Cloudforms Managementengine Enterprise Linux Server Rhel Software Collections and 3 more
CVE-2019-5418

rubygem-actionpack: render file directory traversal in Action View

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

CVSS 3.1 · 7.5 High EPSS 98.5% KEV · Listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Leap and 5 more
CVE-2017-1000385

erlang: TLS server vulnerable to Adaptive Chosen Ciphertext attack allowing plaintext recovery or MITM attack

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).

CVSS 3.0 · 5.9 Medium EPSS 22.1% KEV · Not listed
Vendors
Debian Erlang Redhat
Products
Debian Linux Erlang\/otp Cloudforms Managementengine and 1 more
CVE-2015-1820

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses

REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

CVSS 3.0 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Redhat Rest-client Project
Products
Cloudforms Managementengine Satellite Satellite Capsule and 1 more
CVE-2017-11610

supervisor: Command injection via malicious XML-RPC request

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

CVSS 3.0 · 8.8 High EPSS 87.5% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Cloudforms and 2 more
CVE-2014-3486

CFME: SSH Utility insecure tmp file creation leading to code execution as root

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0066

postgresql: NULL pointer dereference

The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0184

CFME: root password is written to evm.log when entered during VM provisioning

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0078

CFME: multiple authorization bypass vulnerabilities in CatalogController

The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

CVSS 2.0 · 4.0 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0065

postgresql: possible buffer overflow flaws

Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.

CVSS 2.0 · 6.5 Medium EPSS 5.0% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-2669

postgresql: multiple integer overflows in hstore_io.c

Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.

CVSS 2.0 · 6.5 Medium EPSS 3.5% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Rhel Software Collections
CVE-2014-0063

postgresql: stack-based buffer overflow in datetime input/output

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.

CVSS 2.0 · 6.5 Medium EPSS 6.7% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0176

CFME: reflected XSS in several places due to missing JavaScript escaping

Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine Cloudforms Managementengine
CVE-2014-0062

postgresql: CREATE INDEX race condition possibly leading to privilege escalation

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

CVSS 2.0 · 4.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more