CVE-2015-6858

HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2015-6858

HP Insight Control Server Provisioning (HP) is affected by CVE-2015-6858 due to a vulnerability in the RabbitMQ component used by the server provisioning feature prior to version 7.5.0. The issue enables remote attackers to obtain sensitive information via unspecified vectors. The provided docume...

CVE-2015-6858

HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors...

openstack-tripleo-heat-templates: Using hardcoded rabbitmq credentials regardless of supplied values

A flaw was found in the director openstack-tripleo-heat-templates where the RabbitMQ credentials defaulted to guest/guest and supplied values in the configuration were not used. As a result, all deployed overclouds used the same credentials guest/guest. A remote non-authenticated attacker could u...

Moderate: Red Hat Security Advisory: Red Hat Enterprise Linux OpenStack Platform 7 director update

Updated packages that fix two security issues and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 7.0 director for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System...

Yelp: Access to internal CMS containing private Data

On November 21 2015, @nahamsec reported two Yelp IP addresses that were exposing Uchiwa dashboards on port 8080. In that dashboard, he was also able to find a hardcoded password on a Sensu check that gave him access to a RabbitMQ server running on the same machine. The immediate issue was fixed...

Moderate: Red Hat Bug Fix Advisory: Red Hat Enterprise Linux OpenStack Platform Bug Fix and Enhancement Advisory

Updated mariadb-galera, rabbitmq-server, openvswitch, openstack-selinux, openstack-trove, sos-plugins-openstack, and python-eventlet packages that resolve various issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 Icehouse for RHEL 7. Red Hat Enterprise Linux OpenStack...

MGASA-2015-0240 Updated rabbitmq-server packages fix security vulnerabilities

Updated rabbitmq-server package fixes security vulnerabilities: RabbitMQ before 3.4.1 does not prevent /api/ from returning text/html error messages which could act as an XSS vector CVE-2014-9649. RabbitMQ before 3.4.1 has a response-splitting vulnerability in /api/downloads CVE-2014-9650. In...

Updated rabbitmq-server packages fix security vulnerabilities

Updated rabbitmq-server package fixes security vulnerabilities: RabbitMQ before 3.4.1 does not prevent /api/ from returning text/html error messages which could act as an XSS vector CVE-2014-9649. RabbitMQ before 3.4.1 has a response-splitting vulnerability in /api/downloads CVE-2014-9650. In...

Vulnerability in puppetlabs-rabbitmq

Puppet is the United States Puppet Labs a set of client/server C / S architecture based on the configuration management tools , it can be used to manage configuration files , users , cron tasks , packages , system services and so on. puppetlabs-stdlib is one of the implementation of the Advanced...

CVE-2014-9568

puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter...

Design/Logic Flaw

puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter...

CVE-2014-9568

CVE-2014-9568 affects puppetlabs-rabbitmq versions 3.0 through 4.1. The vulnerability arises because the Erlang cookie value is stored in the node’s facts, allowing local users to obtain sensitive information (demonstrated via Facter). Impact is partial confidentiality loss. Exploitation details ...

CVE-2014-9568

puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter...

FreeBSD : rabbitmq -- Security issues in management plugin (8469d41c-a960-11e4-b18e-bcaec55be5e5)

The RabbitMQ project reports : Some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI : - When a user unqueued a message from the management UI, message details header names, arguments, etc. were displayed unescaped. An attacker coul...

Pivotal Software management plugin CRLF injection vulnerability

Pivotal Software RabbitMQ is a British company Pivotal Software's set of implementation of the Advanced Message Queuing Protocol AMQP open source message broker software. RabbitMQ management is one of the management plug-in . A CRLF injection vulnerability exists in the management plugin for...

Pivotal Software RabbitMQ management plugin cross-site scripting vulnerability (CNVD-2015-00813)

Pivotal Software RabbitMQ is a British company Pivotal Software's set of implementation of the Advanced Message Queuing Protocol AMQP open source message broker software. RabbitMQ management is one of the management plug-in . A cross-site scripting vulnerability exists in the management plug-in f...

CVE-2014-9650

CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions...

DEBIAN-CVE-2014-9650

CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions...

CVE-2014-9650

CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions...