131702 matches found
artemis-server: Apache Artemis — session hijack via missing authentication
in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.10-0.3.hum1 aarch64, x8664 grafana12.4-12.4.10-0.3.hum1.src src...
joi: joi: Prototype Pollution via custom messages
A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.12: python3.12-3.12.14-1.2.hum1 aarch64, x8664 python3.12-debug-3.12.14-1.2.hum1 aarch64, x8664 python3.12-devel-3.12.14-1.2.hum1 aarch64, x8664 python3.12-idle-3.12.14-1.2.hum1 aarch64,...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.13: python3.13-3.13.15-1.2.hum1 aarch64, x8664 python3.13-debug-3.13.15-1.2.hum1 aarch64, x8664 python3.13-devel-3.13.15-1.2.hum1 aarch64, x8664 python3.13-freethreading-3.13.15-1.2.hum1...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
joi: joi: Prototype Pollution via custom messages
A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...
grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal
A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.1-0.4.hum1 aarch64, x8664 grafana13.2-13.2.1-0.4.hum1.src src Security Fixes: grafana13.2: CVE-2026-90771...
github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users.
A flaw was found in OpenFGA, an authorization and permission engine. The ListUsers application programming interface API could incorrectly return users who should have been excluded from authorization decisions. This vulnerability arises when complex authorization rules, involving both exclusions...
grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel
A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting XSS payload. This payload executes for every user who opens the dashboard,...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.11: python3.11-3.11.16-1.3.hum1 aarch64, x8664 python3.11-debug-3.11.16-1.3.hum1 aarch64, x8664 python3.11-devel-3.11.16-1.3.hum1 aarch64, x8664 python3.11-idle-3.11.16-1.3.hum1 aarch64,...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.10: python3.10-3.10.21-1.2.hum1 aarch64, x8664 python3.10-debug-3.10.21-1.2.hum1 aarch64, x8664 python3.10-devel-3.10.21-1.2.hum1 aarch64, x8664 python3.10-idle-3.10.21-1.2.hum1 aarch64,...
grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal
A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...
joi: joi: Prototype Pollution via custom messages
A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...
dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.3-0.9.hum1 aarch64, x8664 grafana13.1-13.1.3-0.9.hum1.src src Security Fixes: grafana13.1: CVE-2026-90771...
grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel
A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting XSS payload. This payload executes for every user who opens the dashboard,...
python: Python: FTP connection redirection via ftpcp() function bypass
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...
python: Python: Denial of Service via out-of-bounds write in BZ2 decompression
A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.14: python-unversioned-command-3.14.7-1.2.hum1 noarch python3-3.14.7-1.2.hum1 aarch64, x8664 python3-debug-3.14.7-1.2.hum1 aarch64, x8664 python3-devel-3.14.7-1.2.hum1 aarch64, x8664...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
python: Python/Expat: Denial of Service via crafted XML document
A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...
python: Python unicodedata: Denial of Service due to excessive CPU consumption
A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...
python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers
A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...
Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.13.1 release.
Red Hat Web Terminal Operator 1.13.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...
cups: OpenPrinting CUPS: Remaining case-insensitive username matching in scheduler side paths (CVE-2026-27447 follow-up)
Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cups: cups-2.4.19-4.2.hum1 aarch64, x8664 cups-client-2.4.19-4.2.hum1 aarch64, x8664 cups-devel-2.4.19-4.2.hum1 aarch64, x8664 cups-filesystem-2.4.19-4.2.hum1 noarch cups-ipptool-2.4.19-4.2.hum1...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.6-1.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.6-1.hum1.src src...
rabbitmq-server: RabbitMQ: Unsanitized vhost names allow for XSS in management UI
A flaw was found in RabbitMQ, a messaging and streaming broker. Unsanitized virtual host names allow for XSS in the the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. This vulnerability requires high privileges and user...
rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw
A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...
rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation
A flaw was found in RabbitMQ. A highly privileged remote attacker, with the rabbitmqstreammanagement plugin enabled and access to the target vhost, can exploit an unbounded allocation vulnerability in the super-stream partitions. This allows the attacker to allocate a large amount of memory,...
rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions
A flaw was found in RabbitMQ. When the management plugin is configured with a wildcard Cross-Origin Resource Sharing CORS origin, it incorrectly reflects the attacker's origin and allows credentials. This vulnerability enables a malicious web page to leverage a signed-in administrator's cached...
rabbitmq: RabbitMQ: Denial of Service via unbounded consistent-hash exchange weight
A flaw was found in RabbitMQ. A user with write permission on a consistent-hash exchange and read on a queue can create a binding with an arbitrarily large integer as its routing key, which acts as a hash-ring weight. This unbounded weight causes the broker to allocate a significant amount of...
RabbitMQ: RabbitMQ: Denial of Service via admin-only atom exhaustion from crafted vhost metadata
A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service DoS by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom...
rabbitmq-server: rabbitmq-server: Authentication bypass via improper validation of floating-point token expiration timestamps
A flaw was found in rabbitmq-server. When configured to use OAuth 2.0 authentication, the server does not properly validate token expiration timestamps that are represented as floating-point numbers. A remote attacker with an expired token can exploit this issue to bypass expiration checks, gaini...
rabbitmq-server: rabbitmq-server: Information disclosure via insecure authentication cookies
A flaw was found in rabbitmq-server. This vulnerability allows information disclosure due to insecure handling of authentication cookies following a login request. The application stores base64-encoded user credentials in a cookie that lacks essential security flags, such as Secure, HttpOnly, and...
RabbitMQ: RabbitMQ: Denial of Service via crafted AMQP 1.0 SQL LIKE filter
A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit a Regular Expression Denial of Service ReDoS vulnerability. This occurs when a crafted LIKE filter is processed, leading to excessive CP...
rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component
A flaw was found in RabbitMQ. An authorized policymaker can exploit this vulnerability by issuing a large number of requests with distinct component values to the runtime-parameters lookup path. This action coerces attacker-supplied strings into new atoms, eventually exhausting the Erlang atom...
rabbitmq-server: RabbitMQ: Denial of Service via AMQP 0-9-1 body size validation bypass
A flaw was found in RabbitMQ. An authenticated AMQP 0-9-1 client with publish permissions can exploit a vulnerability in the body assembly process. By declaring an extremely large BodySize and streaming message fragments, the client can bypass size validation, leading to unbounded memory...
rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check
A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...
rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh
A flaw was found in rabbitmq-server. When an existing Advanced Message Queuing Protocol AMQP connection refreshes its authentication token to one with revoked impersonation privileges, the server fails to update the active session's security tags. As a result, an authenticated user can retain...
rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters
A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts...
rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation
A flaw was found in RabbitMQ. A user with management tag and virtual host vhost access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, suc...
rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion
A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated low-privilege AMQP Advanced Message Queuing Protocol user can exploit this vulnerability by creating bindings on an x-jms-topic exchange with specially crafted selector strings. This action causes an exhaustion of...
rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write
A flaw was found in RabbitMQ, a messaging and streaming broker. A user with administrator privileges could exploit a path traversal vulnerability in the tracing plugin. By manipulating the name parameter, an attacker could write a .log-suffixed file to arbitrary filesystem paths writable by the...
rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation
A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...