CVE-2014-0241

CVE-2014-0241 concerns rubygem-hammer_cli_foreman where the file /etc/hammer/cli.modules.d/foreman.yml is world-readable, enabling a local user to read potentially sensitive configuration data (e.g., usernames or passwords) as the underlying issue. Public sources in the provided documents corrobo...

CVE-2014-0241

rubygem-hammercliforeman: File /etc/hammer/cli.modules.d/foreman.yml world readable...

CVE-2014-0212

CVE-2014-0212 concerns qpid-cpp: ACL policies are only loaded when the acl-file option is specified, which can enable a Denial of Service by exhausting all available file descriptors. The connected documents confirm the root cause is loading/processing ACL policies contingent on a missing/omitted...

CVE-2014-0212

qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors...

CVE-2014-0175

mcollective has a default password set at install...

CVE-2014-0175

CVE-2014-0175 relates to mcollective with a default password set at installation. Connected sources corroborate an unpatched/default-credential condition affecting mcollective; CVSS metrics indicate high risk (Network, low attack complexity, no authentication required, partial confidentiality/int...

CVE-2014-7257

CVE-2014-7257 concerns DBD::PgPP, a pure-Perl PostgreSQL client interface. The vulnerability is a SQL injection flaw in DBD::PgPP versions 0.05 and earlier, allowing a remote attacker to execute arbitrary SQL commands if the library is used in a program. The impact is described as high with poten...

CVE-2014-0163

CVE-2014-0163 affects OpenShift and is caused by unsanitized data being passed into shell commands, leading to shell command injection. According to NVD, the CVSS v3.1 base score is 8.8 (HIGH) with Network attack vector, low attack complexity, privileges required: LOW, and user interaction: NONE;...

CVE-2014-0091

The connected documents confirm CVE-2014-0091 affects Foreman, with the underlying issue described as improper input validation that can cause a partial Denial of Service. The sources (NVD, Veracode) consistently report DoS due to input validation problems in Foreman. No concrete vendor/version d...

CVE-2014-0026

CVE-2014-0026 applies to katello-headpin and is due to a CSRF vulnerability in the REST API. The issue is listed with CVSS vectors (2.0: AV:N/AC:M/Au:N/C:N/I:P/A:N; 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicating network access, no confidentiality impact, partial integrity impact, a...

CVE-2014-3656

CVE-2014-3656 corresponds to a JBoss KeyCloak cross-site scripting (XSS) in the login-status-iframe.html page. Public advisories describe that if a Keycloak deployment allows '*' as a permitted web origin in the admin console, crafted requests to login-status-iframe.html can inject arbitrary Java...

EulerOS 2.0 SP2 : gnupg2 (EulerOS-SA-2019-2393)

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in...

EulerOS 2.0 SP2 : cifs-utils (EulerOS-SA-2019-2366)

According to the version of the cifs-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pamcifscreds, allows remote attackers to have...

EulerOS 2.0 SP2 : graphviz (EulerOS-SA-2019-2355)

According to the version of the graphviz packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via forma...

EulerOS 2.0 SP2 : lua (EulerOS-SA-2019-2382)

According to the version of the lua package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service...

EulerOS 2.0 SP2 : gpgme (EulerOS-SA-2019-2406)

According to the versions of the gpgme package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GnuPG Made Easy GPGME is a library designed to make access to GnuPG easier for applications. It provides a high-level crypto API for encryption,...

EulerOS 2.0 SP2 : mod_wsgi (EulerOS-SA-2019-2367)

According to the version of the modwsgi package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - modwsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which migh...

CVE-2014-0242

modwsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread...

camaranazareno.mg.gov.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1035426 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting camaranazareno.mg.gov.br...

CVE-2014-0242

CVE-2014-0242 affects the mod_wsgi Apache module (pre-3.4 in embedded mode). It can cause memory contents to be leaked via the Content-Type header, enabling disclosure of sensitive information. The issue is coupled with CVE-2014-0240 (privilege escalation). Public advisories and Nessus/Gentoo ent...