python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

lzo: lzo1x_decompress_safe() integer overflow

Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.

cas-client: Bypass of security constraints via URL parameter injection

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

eDeploy: Multiple tmp file race condition flaws

eDeploy has tmp file race condition flaws

eDeploy: Remote code execution due to eval() of untrusted data

eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data

eDeploy: Remote code execution due to cPickle deserialization of untrusted data

eDeploy has RCE via cPickle deserialization of untrusted data

KeyCloak: XSS in login status iframe

JBoss KeyCloak: XSS in login-status-iframe.html

KeyCloak: Soft Token deletion via CSRF

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

KeyCloak: Open redirect vulnerability

JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.

AeroGear: stored XSS via deviceToken

Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attacker could use these flaws to compromise the application with specially crafted input.

AeroGear: reflected XSS via password field of the login page

JBoss AeroGear has reflected XSS via the password field

AeroGear: DDoS via deviceToken

The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. But this is user controlled. If a bogus applications is registered with bad deviceTokens, one can generate endless exceptions when those endpoints can't be reached or can slow the server down by purposefully wasting it's time with slow endpoints. Similarly, one can provide whatever HTTP end point they want. This turns the server into a DDOS vector or an anonymizer for the posting of malware and so on.

REST: XXE due to insecure configuration of RestEasy

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy

Origin: XSS in team name

OpenShift Origin: Improperly validated team names could allow stored XSS attacks

rhn_satellite_6: cross-site request forgery (CSRF) can force logout

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Therefore, an attacker can log out a user by having them view specially crafted content.

redhat-upgrade-tool: does not check GPG signatures on package installation

redhat-upgrade-tool: Does not check GPG signatures when upgrading versions

CFME: RHN account info logged to top_output.log during registration

CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration

Ansible prior to 1.5.4 mishandles the evaluation of some strings.

numpy: f2py insecure temporary file use

(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.

zsh: buffer overflow when scanning very long directory paths for symbolic links

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.