Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2017-2625

libXdmcp: weak entropy usage for session keys

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat X.org
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 4 more
CVE-2017-2623

rpm-ostree-client: fails to check gpg package signatures when layering

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default.

CVSS 3.0 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat Rpm-ostree
Products
Enterprise Linux Rhel Atomic Rpm-ostree and 1 more
CVE-2017-2622

openstack-mistral: /var/log/mistral/ is world readable

An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack
CVE-2017-2621

openstack-heat: /var/log/heat/ is world readable

An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Heat Openstack
CVE-2017-2620

Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

CVSS 3.0 · 5.5 Medium EPSS 3.6% KEV · Not listed
Vendors
Citrix Debian Qemu and 2 more
Products
Xenserver Debian Linux Qemu and 9 more
CVE-2017-2619

samba: symlink race permits opening files outside share directory

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.

CVSS 3.1 · 7.5 High EPSS 11.0% KEV · Not listed
Vendors
Debian Redhat Samba
Products
Debian Linux Enterprise Linux Storage and 1 more
CVE-2017-2618

kernel: Off-by-one error in selinux_setprocattr (/proc/self/attr/fscreate)

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 7 more
CVE-2017-2615

Qemu: display: cirrus: oob access while doing bitblt copy backward mode

Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.

CVSS 3.0 · 5.5 Medium EPSS 3.6% KEV · Not listed
Vendors
Citrix Debian Qemu and 2 more
Products
Xenserver Debian Linux Qemu and 9 more
CVE-2017-2614

rhev-m-4: Fails to validate existing expired passwords when changing a password

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Rhev Manager
CVE-2017-2611

jenkins: Insufficient permission check for periodic processes (SECURITY-389)

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2017-2594

hawtio: information Disclosure flaws due to unsafe path traversal

hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.

CVSS 3.0 · 5.4 Medium EPSS 1.8% KEV · Not listed
Vendors
Hawt Redhat
Products
Hawtio Jboss Amq Jboss Fuse
CVE-2017-2592

python-oslo-middleware: CatchErrors leaks sensitive values into error logs

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Oslo.middleware Openstack
CVE-2017-2591

389-ds-base: Heap buffer overflow in uiduniq.c

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.

CVSS 3.0 · 3.7 Low EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Enterprise Linux
CVE-2017-2590

ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.

CVSS 3.0 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Freeipa Redhat
Products
Freeipa Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2017-2589

hawtio: Proxy is sharing cookies among all the clients

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.

CVSS 3.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hawt Redhat
Products
Hawtio Jboss Amq Jboss Fuse
CVE-2017-2585

keycloak: timing attack in JWS signature verification

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

CVSS 3.0 · 5.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Server Jboss Single Sign On Keycloak and 2 more
CVE-2017-2582

keycloak: SAML request parser replaces special strings with system properties

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Keycloak
CVE-2017-18926

raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer

raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).

CVSS 3.1 · 7.1 High EPSS 3.0% KEV · Not listed
Vendors
Debian Fedoraproject Librdf and 1 more
Products
Debian Linux Fedora Raptor Rdf Syntax Library and 1 more
CVE-2017-18922

libvncserver: websocket decoding buffer overflow

It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed
Vendors
Canonical Fedoraproject Libvncserver Project and 3 more
Products
Ubuntu Linux Fedora Libvncserver and 16 more