Vendor
[UNKNOWN]
239 known vulnerabilities.
Products
239 results · Feed
-
High 7.5
Use of Externally-Controlled Input to Select Classes or Code in Infinispan
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce n…
-
Medium 5.9
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-te…
-
High 7.4
It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacke…
-
Medium 6.5
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute v…
-
Medium 4.7
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…
-
High 7.0
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…
-
High 7.0
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…
-
High 7.5
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenti…
-
Medium 5.4CVE-2019-3847 Public exploit
Moodle XSS Vulnerability
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to t…
-
Medium 4.0
Ceilometer Prints Sensitive Configuration Data to Log
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
-
Medium 6.1
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could ex…
-
Medium 4.3
Moodle context freezing
A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities
-
Medium 4.3
Moodle Secure layout contained an insecure link in Boost theme
A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page.
-
Medium 4.3
Moodle Stored HTML in assignment submission comments allowed links to be opened directly
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no…
-
Medium 6.3
Moodle Users could elevate their role when accessing the LTI tool on a provider site
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
-
Medium 5.5
Openstack Octavia allows Insertion of Sensitive Information into Log File
In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private key…
-
Medium 4.3
Moodle Logged in users could view all calendar events
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar event…
-
High 7.5
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial …
-
Unscored —
In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST in…
-
High 7.0
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modi…
-
High 7.8
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which coul…
-
Medium 5.4
A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict …
-
Medium 6.5
Moodle Blind SSRF Risk in /badges/mybackpack.php
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note tha…
-
Medium 6.4
A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function…
-
Medium 4.3
Moodle XSS Vulnerability
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is …
-
Medium 5.3
It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an…
-
Low 3.3
It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of…
-
High 7.5CVE-2019-3833 EPSS 15%
Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing spe…
-
High 7.5CVE-2019-3816 EPSS 15%
Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working director…
-
Low 3.7
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS c…
-
Medium 6.8
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change config…
-
Low 3.5
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt …
-
Medium 6.5
It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMA…
-
High 7.3
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration chan…
-
Low 2.5
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_ui…
-
Medium 6.5
A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the s…
-
High 7.5CVE-2018-16873 EPSS 66%
Remote command execution via "go get" with "-u" flag in cmd/go
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is on…
-
Medium 5.9CVE-2018-16875 Public exploit
Denial of service in chain verification in crypto/x509
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting…
-
Medium 6.8
Directory traversal via "go get" command in cmd/go
In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable…