Lucene search

K

7 matches found

cve
cve
added 2021/05/27 12:15 a.m.244 views

CVE-2021-3509

A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The g...

6.1CVSS5.8AI score0.0081EPSS
cve
cve
added 2021/05/18 12:15 p.m.236 views

CVE-2021-3531

A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability.

5.3CVSS5.6AI score0.00257EPSS
cve
cve
added 2021/05/17 5:15 p.m.229 views

CVE-2021-3524

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection...

6.5CVSS6.7AI score0.00589EPSS
cve
cve
added 2021/01/08 6:15 p.m.225 views

CVE-2020-25678

A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible.

4.4CVSS4.9AI score0.00022EPSS
cve
cve
added 2021/12/08 10:15 p.m.206 views

CVE-2021-4048

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portion...

9.1CVSS9.1AI score0.00365EPSS
cve
cve
added 2021/04/15 3:15 p.m.199 views

CVE-2021-20288

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associ...

7.2CVSS6.8AI score0.00179EPSS
cve
cve
added 2021/05/28 11:15 a.m.162 views

CVE-2021-20236

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as w...

9.8CVSS9.2AI score0.00377EPSS