CVE-2018-10869

redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd...

Design/Logic Flaw

redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd...

CVE-2018-10869

redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd...

CVE-2018-10870

redhat-certification does not properly sanitize paths in rhcertStore.py:saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution...

CVE-2018-10870

CVE-2018-10870 affects the Red Hat package redhat-certification. The issue is in rhcertStore.py:__saveResultsFile, which allows writing arbitrary files and can lead to remote code execution. Public sources (NVD, RHSA-2018:2373) describe the vulnerability as high/critical with network attack vecto...

CVE-2018-10869

The CVE-2018-10869 vulnerability affects redhat-certification and allows a remote attacker to download any file accessible by the web server user via the /download page due to improper access restriction. Red Hat’s RHSA-2018:2373 (and related advisories) document this issue and provide a security...

CVE-2018-10869

It was discovered that redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd. Mitigation If SELinux is enabled it further restricts the set of files that can be downloaded...

CVE-2018-10870

It has been discovered that redhat-certification does not properly sanitize paths in rhcertStore.py:saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution. Mitigation If SELinux is enabled it further restricts the set of files an...

RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 (RHSA-2018:2186)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2186 advisory. This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering. This release serves as a...

RHEL 7 : ansible (RHSA-2018:2152)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2152 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH a...

RHEL 7 : gnupg2 (RHSA-2018:2181)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2181 advisory. The GNU Privacy Guard GnuPG or GPG is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Securi...

RHEL 7 : ansible (RHSA-2018:2151)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2151 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH a...

RHEL 6 : kernel (RHSA-2018:2164)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2164 advisory. - hw: cpu: speculative store bypass CVE-2018-3639 - Kernel: FPU state information leakage via lazy FPU restore CVE-2018-3665 - kernel: mm:...

RHEL 6 : java-1.8.0-ibm (RHSA-2018:1975)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1975 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

RHEL 6 : firefox (RHSA-2018:2112)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2112 advisory. - Mozilla: address bar username and password spoofing in reader mode CVE-2017-7762 - Mozilla: Media recorder segmentation fault when track...

Apache CXF CVE-2018-8039 TLS Hostname Verification Security Bypass Vulnerability

Description Apache CXF is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks. The following versions of product are vulnerable: Apache CXF 3.1.16...

RHEL 7 : qemu-kvm-rhev (RHSA-2018:2060)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2060 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the...

RHEL 6 : patch (RHSA-2018:2095)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2095 advisory. The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to...

RHEL 7 : patch (RHSA-2018:2092)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2092 advisory. The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to...

RHEL 6 : patch (RHSA-2018:2096)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2096 advisory. The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to...