Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2016-7062

rhscon-ceph: password leak by command line parameter

rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Rhscon Storage Console Storage Console Node
CVE-2017-7481

ansible: Security issue with lookup return not tainting the jinja2 environment

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Ansible Engine and 11 more
CVE-2017-2665

rhscon-core: creates world readable file /etc/skyring/skyring.conf which leaks mongodb password for skyring database

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb Redhat
Products
Mongodb Storage Console