Vendor
[UNKNOWN]
239 known vulnerabilities.
Products
145 results · Clear filters · Feed
-
Medium 5.3
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. …
-
Medium 5.0
The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privilege…
-
Medium 6.5
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploa…
-
Medium 4.3
Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially l…
-
Medium 5.3
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leadin…
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_d…
-
Medium 5.5
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in E…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/tran…
-
Medium 4.1
The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacke…
-
Medium 6.5CVE-2017-2666 Public exploit
Undertow-core vulnerable to HTTP Request Smuggling
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…
-
Medium 6.5
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks d…
-
Medium 6.5
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when u…
-
Medium 5.9
An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperl…
-
Medium 4.2
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of s…
-
Medium 5.0
A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() f…
-
Medium 4.2
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry…
-
Medium 5.5
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a cr…
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
-
Medium 4.4
Moderate severity vulnerability that affects org.keycloak:keycloak-core
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw…
-
Medium 5.9
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTick…
-
Medium 5.3
Ansible fails to properly mark lookup-plugin results as unsafe
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code e…
-
Medium 6.8
OpenStack Identity service (keystone) Incorrect Authorization
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrat…
-
Medium 5.9
git-annex private data exfiltration to compromised remote
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.
-
Medium 4.3
The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", f…
-
Medium 5.9
git-annex GPG decryption attack via compromised remote
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data that wa…
-
Medium 4.8
In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client ce…
-
Medium 6.5
Infinispan Rest API Does Not Enforce Auth Constraints
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
-
Medium 4.7
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_a…
-
Medium 6.3
Moodle XSS Vulnerability
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
-
Medium 4.3
Moodle Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
-
Medium 4.3
Moodle sensitive information disclosure
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
-
Medium 6.3
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pat…
-
Medium 4.8
The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to …
-
Medium 6.5
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash…
-
Medium 4.8
setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to …
-
Medium 5.9
Ansible exposes sensitive data in log files and on the terminal
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expo…
-
Medium 5.3
Podman Elevated Container Privileges
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
-
Medium 5.4CVE-2018-10860 EPSS 42%
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did …