CVE-2023-3628

Infispan: rest bulk ops don't check permissions

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Infinispan Redhat

Products

Infinispan Data Grid Jboss Data Grid and 1 more

CVE-2023-4061

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform Wildfly Core

CVE-2023-5408

Openshift: modification of node role labels

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2023-4956

Quay: clickjacking on config-editor page severity

A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2024-9683

Quay: quay allows successful authentication with trucated version of the password

A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overall security of password enforcement.  While the risk is relatively low due to the typical length of the passwords used (73 characters), this vulnerability can still be exploited to reduce the complexity of brute-force or password-guessing attacks. The truncation of passwords weakens the overall authentication process, thereby reducing the effectiveness of password policies and potentially increasing the risk of unauthorized access in the future.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2023-4959

Quay: cross-site request forgery (csrf) on config-editor page

A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2024-36387

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed

Vendors

Apache Netapp Redhat

Products

Http Server Ontap Enterprise Linux and 1 more

CVE-2024-5696

Mozilla: Memory Corruption in Text Fragments

By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 5 more

CVE-2024-0690

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ansible Ansible Automation Platform and 5 more

CVE-2019-13272

kernel: broken permission and object lifetime handling for PTRACE_TRACEME

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

CVSS 3.1 · 7.8 High EPSS 52.2% KEV · Listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 22 more

CVE-2021-3560

polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync()

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS 21.8% KEV · Listed

Vendors

Canonical Debian Polkit Project and 1 more

Products

Ubuntu Linux Debian Linux Polkit and 7 more

CVE-2022-0847

kernel: improper initialization of the "flags" member of the new pipe_buffer

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS 92.8% KEV · Listed

Vendors

Fedoraproject Linux Netapp and 4 more

Products

Fedora Linux Kernel H300e and 39 more

CVE-2022-0185

kernel: fs_context: heap overflow in legacy parameter handling

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

CVSS 3.1 · 8.4 High EPSS 25.2% KEV · Listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300e H300e Firmware and 17 more

CVE-2021-4034

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVSS 3.1 · 7.8 High EPSS 94.9% KEV · Listed

Vendors

Canonical Oracle Polkit Project and 4 more

Products

Ubuntu Linux Http Server Zfs Storage Appliance Kit and 34 more

CVE-2022-0866

wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Openstack Platform Red Hat Single Sign On and 1 more

CVE-2018-1000861

jenkins: code execution through crafted URLs (SECURITY-595)

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.

CVSS 3.1 · 9.8 Critical EPSS 98.3% KEV · Listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift Openshift Container Platform

CVE-2024-36971

net: fix __dst_negative_advice() race

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2023-41993

webkitgtk: processing malicious web content may lead to arbitrary code execution

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVSS 3.1 · 8.8 High EPSS 23.7% KEV · Listed

Vendors

Apple Debian Fedoraproject and 4 more

Products

Ipad Os Ipados Iphone Os and 14 more

CVE-2019-18860

squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.

CVSS 3.1 · 6.1 Medium EPSS 5.0% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Leap and 2 more

CVE-2025-58364

cups: Remote DoS via null dereference

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Linux Openprinting Redhat

Products

Linux Cups Enterprise Linux