Latest CVE Feed
-
6.2
MEDIUMCVE-2018-10864
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Se... Read more
- Published: Aug. 13, 2018
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2018-10863
It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory, through the /rhcert-transfer URL. An unauthorized attacker may use this flaw to gather sensibl... Read more
Affected Products : certification- Published: May. 26, 2021
- Modified: Nov. 21, 2024
-
5.5
MEDIUMCVE-2018-10862
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.... Read more
Affected Products : enterprise_linux virtualization jboss_enterprise_application_platform wildfly_core- Published: Jul. 27, 2018
- Modified: Nov. 21, 2024
-
8.1
HIGHCVE-2018-10861
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affect... Read more
- Published: Jul. 10, 2018
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2018-10860
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use... Read more
- Published: Jun. 29, 2018
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2018-10859
git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's gpg key. This attack could be used to expose encrypted data tha... Read more
- Published: Jul. 16, 2018
- Modified: Nov. 21, 2024
-
8.8
HIGHCVE-2018-10858
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4... Read more
- Published: Aug. 22, 2018
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2018-10857
git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located outside the git-annex repository, or content from a private web server on localhost or the LAN.... Read more
- Published: Jul. 16, 2018
- Modified: Nov. 21, 2024
-
8.8
HIGHCVE-2018-10856
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.... Read more
Affected Products : libpod- Published: Jul. 03, 2018
- Modified: Nov. 21, 2024
-
5.9
MEDIUMCVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will ... Read more
- Published: Jul. 03, 2018
- Modified: Nov. 21, 2024
-
6.5
MEDIUMCVE-2018-10854
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name fi... Read more
- Published: Nov. 22, 2019
- Modified: Nov. 21, 2024
-
7.8
HIGHCVE-2018-10853
A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could u... Read more
- Published: Sep. 11, 2018
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2018-10852
The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any... Read more
Affected Products : debian_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation sssd- Published: Jun. 26, 2018
- Modified: Nov. 21, 2024
-
7.5
HIGHCVE-2018-10851
PowerDNS Authoritative Server 3.3.0 up to 4.1.4 excluding 4.1.5 and 4.0.6, and PowerDNS Recursor 3.2 up to 4.1.4 excluding 4.1.5 and 4.0.9, are vulnerable to a memory leak while parsing malformed records that can lead to remote denial of service.... Read more
- Published: Nov. 29, 2018
- Modified: Nov. 21, 2024
-
7.1
HIGHCVE-2018-10850
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.... Read more
- Published: Jun. 13, 2018
- Modified: Nov. 21, 2024
-
8.8
HIGHCVE-2018-10847
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate thei... Read more
Affected Products : prosody- Published: Jul. 30, 2018
- Modified: Nov. 21, 2024
-
5.6
MEDIUMCVE-2018-10846
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text ... Read more
- Published: Aug. 22, 2018
- Modified: Nov. 21, 2024
-
5.9
MEDIUMCVE-2018-10845
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data usi... Read more
- Published: Aug. 22, 2018
- Modified: Nov. 21, 2024
-
5.9
MEDIUMCVE-2018-10844
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data usin... Read more
- Published: Aug. 22, 2018
- Modified: Nov. 21, 2024
-
9.0
HIGHCVE-2018-10843
source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An a... Read more
Affected Products : openshift_container_platform- Published: Jul. 02, 2018
- Modified: Nov. 21, 2024