Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2007-1462

security flaw

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the web page. NOTE: there are limited circumstances under which such an attack is feasible.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Conga Redhat
Products
Conga Linux Rhel Cluster
CVE-2007-4136

ricci is vulnerable to a connect DoS attack

The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.

CVSS 2.0 · 5.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Conga Rhel Cluster
CVE-2014-3521

luci: unauthorized administrative access granted to non-administrative users

The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.

CVSS 2.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Conga Rhel Cluster
CVE-2013-6496

conga: Multiple information leak flaws in various luci site extensions

Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Conga Rhel Cluster
CVE-2013-7347

conga: insecure handling of luci web interface sessions

Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Conga Enterprise Linux
CVE-2012-3359

conga: insecure handling of luci web interface sessions

Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Conga Enterprise Linux Rhel Cluster
CVE-2011-0720

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Conga Luci and 1 more
CVE-2010-3852

Luci: Authentication bypass via fake ticket cookie

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.

CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Conga Luci