Archive
27 July 2018
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect t…
-
High 8.3
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a clien…
-
High 7.5
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker cou…
-
High 8.2
It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1…
-
High 8.5
Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass
It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.
-
High 8.8
Missing permission checks in Jenkins Distributed Fork Plugin
It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that provides the dist-fork CLI command beyond the basic check for Overall/Read permission, allowing anyone with that permission …
-
High 8.1
Jenkins Active Directory Plugin did not verify certificate of AD server
It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.
-
High 7.8
A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4.…
-
High 7.5
It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used t…
-
High 7.3
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A loc…
-
High 7.5
Keycloak vulnerable to infinite loop based Denial of Service
It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.
-
High 7.5
An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server …
-
High 8.1
A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check th…
-
High —
Path Traversal in superstatic
Affected of `superstatic` are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a kn…
-
High 8.4
A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM rep…
-
High 7.2
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Onl…
-
High 7.5
Moderate severity vulnerability that affects io.undertow:undertow-core
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
-
High 7.7
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…
-
High 7.5
An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL po…
-
High 7.0
Drive Encryption (MDE) - Authentication Bypass vulnerability
Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local security protection via specific set of circumstances.
-
High 8.7
It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE fl…
-
High 7.4
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max…