Lucene search

K

3Scale Api Management Security Vulnerabilities

cve
cve

CVE-2019-10216

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of r...

7.8CVSS

7.6AI Score

0.001EPSS

2019-11-27 01:15 PM
324
2
cve
cve

CVE-2019-14836

A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.

8.8CVSS

8.4AI Score

0.001EPSS

2021-05-26 12:15 PM
33
2
cve
cve

CVE-2019-14852

A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.

7.5CVSS

7.3AI Score

0.001EPSS

2021-03-18 08:15 PM
30
6
cve
cve

CVE-2020-14388

A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.

6.3CVSS

6.2AI Score

0.001EPSS

2021-06-02 01:15 PM
32
3
cve
cve

CVE-2020-25634

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected.

5.4CVSS

5.2AI Score

0.001EPSS

2021-05-26 09:15 PM
41
2
cve
cve

CVE-2021-20252

A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal ser...

6.5CVSS

6.2AI Score

0.001EPSS

2021-02-23 11:15 PM
30
4
cve
cve

CVE-2021-3412

It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.

7.3CVSS

7.3AI Score

0.001EPSS

2021-06-01 02:15 PM
35
5
cve
cve

CVE-2021-3609

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

7CVSS

7.2AI Score

0.0004EPSS

2022-03-03 07:15 PM
224
cve
cve

CVE-2021-3656

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malici...

8.8CVSS

8.6AI Score

0.0004EPSS

2022-03-04 07:15 PM
256
cve
cve

CVE-2022-0330

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

7.8CVSS

7.7AI Score

0.0004EPSS

2022-03-25 07:15 PM
331
5
cve
cve

CVE-2022-1414

3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.

8.8CVSS

8.6AI Score

0.001EPSS

2022-10-19 06:15 PM
33
10
cve
cve

CVE-2023-4910

A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.

5.5CVSS

5.4AI Score

0.0004EPSS

2023-11-06 01:15 PM
58