Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 27

Export CSV
CVE-2007-0240

security flaw

Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.

CVSS 2.0 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat Zope
Products
Rhel Cluster Zope
CVE-2007-1462

security flaw

The luci server component in conga preserves the password between page loads for the Add System/Cluster task flow by storing the password in the Value attribute of a password entry field, which allows attackers to steal the password by performing a "view source" or other operation to obtain the web page. NOTE: there are limited circumstances under which such an attack is feasible.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Conga Redhat
Products
Conga Linux Rhel Cluster
CVE-2007-3380

security flaw

The Distributed Lock Manager (DLM) in the cluster manager for Linux kernel 2.6.15 allows remote attackers to cause a denial of service (loss of lock services) by connecting to the DLM port, which probably prevents other processes from accessing the service.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Cluster
CVE-2007-4136

ricci is vulnerable to a connect DoS attack

The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.

CVSS 2.0 · 5.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Conga Rhel Cluster
CVE-2008-4192

cman/fence: insecure temporary file usage in the egenera fence agent

The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cman Enterprise Linux Rhel Cluster
CVE-2008-4579

cman/fence: insecure temporary file usage in the apc fence agents

The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Gentoo Redhat
Products
Cman Fence Enterprise Linux and 1 more
CVE-2008-6552

rgmanager: multiple insecure temporary file use issues

Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Cluster Project Cman and 4 more
CVE-2014-3521

luci: unauthorized administrative access granted to non-administrative users

The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.

CVSS 2.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Conga Rhel Cluster
CVE-2012-3359

conga: insecure handling of luci web interface sessions

Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Conga Enterprise Linux Rhel Cluster
CVE-2012-5485

(Plone): Restricted Python injection

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVSS 2.0 · 6.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Rhel Cluster
CVE-2012-5486

(Plone): Reflexive HTTP header injection

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVSS 2.0 · 6.4 Medium EPSS 2.5% KEV · Not listed
Vendors
Plone Redhat Zope
Products
Plone Rhel Cluster Zope
CVE-2012-5488

(Plone): Restricted Python injection

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Rhel Cluster
CVE-2012-5497

(Plone): Anonymous users can list user account names

membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Rhel Cluster
CVE-2012-5498

(Plone): Partial denial of service through Collections functionality

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.

CVSS 2.0 · 5.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Rhel Cluster
CVE-2012-5499

(Plone): Partial denial of service through internal function

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Rhel Cluster
CVE-2012-5500

(Plone): Anonymous users can batch change titles of content items

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.

CVSS 2.0 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Plone Redhat
Products
Plone Rhel Cluster
CVE-2013-6496

conga: Multiple information leak flaws in various luci site extensions

Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Conga Rhel Cluster
CVE-2010-0727

kernel: bug in GFS/GFS2 locking code leads to dos

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2010-0743

scsi-target-utils: format string vulnerability

Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Iscsitarget Redhat Zaal
Products
Iscsitarget Rhel Cluster Storage Tgt
CVE-2010-1104

zope: XSS on error page

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat Zope
Products
Rhel Cluster Zope