CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Pagure: XSS possible in file attachment endpoint |
| 06/11/2019 |
| CVE-2013-5123 | MEDIUM5.9 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. | 05/11/2019 |
| CVE-2010-2222 | HIGH7.5 | The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer dereference) via a crafted search query. | 05/11/2019 |
| CVE-2013-6461 | MEDIUM6.5 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits | 05/11/2019 |
| CVE-2013-6460 | MEDIUM6.5 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents | 05/11/2019 |
| CVE-2019-10223 | MEDIUM6.5 | A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` | 05/11/2019 |
| CVE-2013-4374 | HIGH7.1 | An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files. | 04/11/2019 |
| CVE-2013-4280 | MEDIUM5.5 | Insecure temporary file vulnerability in RedHat vsdm 4.9.6. | 04/11/2019 |
| CVE-2014-3649 | MEDIUM6.1 | JBoss AeroGear has reflected XSS via the password field | 04/11/2019 |
| CVE-2013-4518 | MEDIUM5.5 | RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates | 04/11/2019 |
| CVE-2013-4423 | MEDIUM5.5 | CloudForms stores user passwords in recoverable format | 04/11/2019 |
| CVE-2013-2255 | MEDIUM5.9 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. | 01/11/2019 |
| CVE-2013-0186 | MEDIUM6.1 | Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 01/11/2019 |
| CVE-2011-3923 | CRITICAL9.8 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. | 01/11/2019 |
| CVE-2010-2783 | CRITICAL9.1 | IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services. | 31/10/2019 |
| CVE-2010-2548 | CRITICAL9.1 | IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files. | 31/10/2019 |
| CVE-2010-0737 | HIGH8.0 | A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user. | 30/10/2019 |