Vendor
[UNKNOWN]
239 known vulnerabilities.
Products
145 results · Clear filters · Feed
-
Medium 5.0
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup …
-
Medium 6.5
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind …
-
Medium 6.5
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with acces…
-
Medium 5.0
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add o…
-
Medium 6.5
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the di…
-
Medium 5.3
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and in…
-
Medium 4.3
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3li…
-
Medium 5.5
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable …
-
Medium 5.9
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persiste…
-
Medium 6.5
routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which …
-
Medium 5.0
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When eng…
-
Medium 6.4
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo execu…
-
Medium 4.4
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by F…
-
Medium 4.8
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/intege…
-
Medium 4.3
Inadequate Encryption Strength in Jenkins
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which th…
-
Medium 4.2
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the …
-
Medium 5.4
Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and vali…
-
Medium 5.4
Cross-Site Request Forgery in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (S…
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
-
Medium 4.3
Improper Authentication in Jenkins
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
-
Medium 5.4
Incorrect Permission Assignment for Critical Resource in Jenkins
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK.
-
Medium 4.3
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that al…
-
Medium 5.4
Incorrect Authorization in Jenkins
Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).