Archive
July 2018
Vulnerabilities first published in this month (UTC), newest first.
220 results · Clear filters · Feed
-
Medium 5.3
The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…
-
Medium 5.3
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…
-
Medium 6.3
Ansible apt_key module does not properly verify key fingerprint
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
-
Medium 5.3
The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …
-
Medium 6.3
The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with ac…
-
Medium 4.3
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v…
-
Medium 6.4
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI.…
-
Medium 6.5
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an a…
-
Medium 5.4
IBM Sterling B2B Integrator Standard Edition 5.2.0.1 - 5.2.6.3 is vulnerable to cross-site scripting. This vulnerabilit…
-
Medium 5.9
IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a use…
-
Medium 6.1
metascraper before v5.2.0 vulnerable to stored cross-site scripting
There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_d…
-
Medium 5.5
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in E…
-
Medium 4.3
A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before ver…
-
Medium 5.5
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; …
-
Medium 6.8
Jenkins SSH Build Agents Plugin did not verify host keys
It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.
-
Medium 6.5
Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to t…
-
Medium 5.5
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds…
-
Medium 5.5
A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. A…
-
Medium 4.3
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the…
-
Medium 5.4
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This fl…
-
Medium 5.5
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local…
-
Medium 4.9
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create…
-
Medium 5.2
It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially u…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/tran…
-
Medium 6.1
JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, …
-
Medium 5.5
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD…
-
Medium 4.5
An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the appli…
-
Medium 5.3
It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages…
-
Medium 5.9
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a seri…
-
Medium 6.1
JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The fla…
-
Medium 6.5
It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user syst…
-
Medium 5.9
An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a se…
-
Medium 4.1
A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instea…
-
Medium 6.8
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for th…
-
Medium 4.5
An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the appli…
-
Medium 4.3
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying …
-
Medium 5.8
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. …
-
Medium 4.1
The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacke…