Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2014-3593

luci: privilege escalation through cluster with specially crafted configuration

Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.

CVSS 2.0 · 6.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Scientificlinux
Products
Enterprise Linux Luci
CVE-2010-3852

Luci: Authentication bypass via fake ticket cookie

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.

CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Conga Luci
CVE-2011-0720

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Conga Luci and 1 more
CVE-2013-4481

luci: short exposure of authentication secrets while generating configuration file

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Scientificlinux
Products
Enterprise Linux Luci
CVE-2013-4482

luci: paster hidden untrusted path and "command" (callable association) injection

Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.

CVSS 2.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Scientificlinux
Products
Enterprise Linux Luci