Vendor
[UNKNOWN]
239 known vulnerabilities.
Products
239 results · Feed
-
Medium 5.0
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup …
-
Low 3.8
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, whi…
-
High 8.0
Ansible Arbitrary Code Execution
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this…
-
Medium 6.5
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind …
-
Low 3.7
Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user au…
-
Medium 6.5
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with acces…
-
Low 2.8CVE-2018-1120 Public exploit
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memor…
-
High 7.5
A flaw was found in Opendaylight's SDNInterfaceapp (SDNI). Attackers can SQL inject the component's database (SQLite) w…
-
Medium 5.0
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add o…
-
Medium 6.5
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the di…
-
Medium 5.3
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and in…
-
Medium 4.3
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3li…
-
Medium 5.5
In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable …
-
Critical 9.0
openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certifica…
-
Low 3.9CVE-2018-1121 Public exploit
procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() retur…
-
Medium 5.9
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persiste…
-
Medium 6.5
routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which …
-
Medium 5.0
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When eng…
-
Medium 6.4
sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo execu…
-
Medium 4.4
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by F…
-
High 7.3CVE-2018-1122 Public exploit
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unse…
-
Low 3.9CVE-2018-1123 Public exploit
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection…
-
Medium 4.8
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/intege…
-
High 7.3CVE-2018-1124 Public exploit
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec…
-
Medium 4.3
Inadequate Encryption Strength in Jenkins
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which th…
-
High 7.6
hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerab…
-
Medium 4.2
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the …
-
Medium 5.4
Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and vali…
-
Medium 5.4
Cross-Site Request Forgery in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (S…
-
Medium 5.4
Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
-
Low 3.1
Incomplete List of Disallowed Inputs in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
-
Low 2.6
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).
-
Medium 4.3
Improper Authentication in Jenkins
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
-
High 8.8
Deserialization of Untrusted Data in Jenkins
Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
-
Medium 4.3
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes (SECURITY-343).
-
Medium 5.4
Incorrect Permission Assignment for Critical Resource in Jenkins
In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK.
-
Medium 4.3
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that al…
-
Medium 5.4
Incorrect Authorization in Jenkins
Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).