Authorization

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him...

CVE-2018-10868

CVE-2018-10868 concerns Red Hat Certification (redhat-certification) 7, where the XML parser allows an unbounded number of recursive entity definitions. The root cause is improper restriction of recursive definitions in XML documents, enabling an unauthenticated user to trigger a memory/time exha...

CVE-2018-10868

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host...

CVE-2018-10867

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user...

CVE-2018-10867

CVE-2018-10867 affects Red Hat redhat-certification 7. The flaw is an access-control error on the /update/results page, allowing a remote attacker to delete any file accessible by the user running httpd (apache). Root cause: insufficient access restriction for update results. Impact: potential da...

CVE-2018-10866

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him...

CVE-2018-10866

CVE-2018-10866 affects redhat-certification version 7. The vulnerability stems from the /configuration view not performing an authorization check, enabling an unauthenticated user to remove a host-specific XML file (a “system” file). This represents an integrity/availability risk without requirin...

CVE-2018-10865

The vulnerability CVE-2018-10865 affects redhat-certification version 7 and involves the /configuration view lacking proper authorization. An unauthenticated user can call a restart RPC method on any host accessible by the system, even if not owned by them, potentially causing disruption or denia...

CVE-2018-10863

It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory, through the /rhcert-transfer URL. An unauthorized attacker may use this flaw to gather sensible information...

CVE-2018-10863

CVE-2018-10863 affects redhat-certification 7, where improper configuration allows listing all files/directories under /var/www/rhcert/store/transfer via the /rhcert-transfer URL, enabling information disclosure. The impact is exposure of sensitive information, per multiple connected records. Exp...

PT-2021-8691 · Red Hat · Redhat-Certification

Name of the Vulnerable Software and Affected Versions: redhat-certification version 7 Description: The issue concerns the /configuration view, which lacks an authorization check. This allows an unauthenticated user to invoke a restart RPC method on any accessible host, regardless of ownership...

PT-2021-8690 · Red Hat · Redhat-Certification

Name of the Vulnerable Software and Affected Versions: redhat-certification version 7 Description: The issue is related to improper configuration, which allows listing of all files and directories in the /var/www/rhcert/store/transfer directory through the "/rhcert-transfer" API endpoint. This...

RHEL 7 : openvswitch (RHSA-2021:2077)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2077 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic...

RHEL 8 : libxml2 (RHSA-2021:1597)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1597 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Buffer overflow...

RHEL 8 : exiv2 (RHSA-2021:1758)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1758 advisory. The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments. The followin...

RHEL 8 : redis:6 (RHSA-2021:2034)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2034 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and...

RHEL 8 : linux-firmware (RHSA-2021:1620)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1620 advisory. The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fixes: kernel: Integ...

RHEL 8 : raptor2 (RHSA-2021:1842)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1842 advisory. Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples...

RHEL 8 : brotli (RHSA-2021:1702)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1702 advisory. Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffma...

RHEL 8 : perl (RHSA-2021:1678)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1678 advisory. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: per...