Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2012-5605

Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions

A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This could lead to unauthorized data tampering within the application's cache.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Cloudforms Tools Redhat
Products
1 1 Cloudforms
CVE-2012-4574

Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file

A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized access to sensitive system credentials.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Cloudforms Tools Redhat
Products
1 1 Cloudforms and 1 more
CVE-2012-3503

Katello: Application.config.secret_token is not generated properly

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Cloudforms Systemengine Redhat Rhel Sam and 1 more
Products
1 Enterprise Linux Server 1.1 and 1 more
CVE-2012-5561

Katello: /etc/katello/secure/passphrase is world readable

script/katello-generate-passphrase in Katello 1.1 uses world-readable permissions for /etc/katello/secure/passphrase, which allows local users to obtain the passphrase by reading the file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Katello Rhel Sam
Products
1 Katello 1.2
CVE-2012-6116

Candlepin: bootstrap RPM deploys CA certificate file with mode 666

modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Systemengine Katello Rhel Sam
Products
1 Katello Katello-configure and 1 more