Archive
4 January 2013
Vulnerabilities first published on this day (UTC), newest first.
22 results · Feed
-
Unscored —
Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the des…
-
Unscored —
The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k cur…
-
Unscored —
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote atta…
-
Unscored —
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interr…
-
Unscored —
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to caus…
-
Medium 5.5
Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file
A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized …
-
Unscored —
Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users …
-
Unscored —
The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which …
-
Unscored —
Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when moving disks between storage domains, does not prop…
-
Low 3.3
Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions
A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This could lead to unauthor…
-
Unscored —
proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows rem…
-
Unscored —
Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (…
-
Unscored —
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly han…
-
Unscored —
Centrify Deployment Manager 2.1.0.283, as distributed in Centrify Suite before 2012.5, allows local users to (1) overwr…
-
Unscored —
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows …
-
Unscored —
Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 befo…
-
Unscored —
Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x befor…
-
Unscored —
Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3…
-
Unscored —
Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x…
-
Medium —
Authlogic Information Exposure vulnerability
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments tha…
-
High —
Active Record contains SQL Injection
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic…