TI-2019-08127 CVE-2019-10906 · GHSA-462w-v97r-4m45
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Priority MEDIUM 44
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
RHSA-2019:3172
Red Hat Satellite 6 security, bug fix, and enhancement update
Released 2019-10-22 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Satellite 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
- Red Hat Satellite Capsule 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
Fixes 9 records
TI-2016-08785 CVE-2016-10745 · GHSA-hj2j-77xm-mc5v
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Priority MEDIUM 43
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
TI-2018-15986 CVE-2018-1000632 · GHSA-6pcc-3rfx-4gpm
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in…
Priority MEDIUM 42
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element.
TI-2018-11812 CVE-2018-16470 · GHSA-hg78-4f6x-99wq
Uncontrolled resource consumption in Rack
Priority LOW 37
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6.
TI-2019-09235 CVE-2019-12387 · GHSA-6cc5-2vg4-cc7m
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods…
Priority LOW 32
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
TI-2019-07519 CVE-2019-10198 · GHSA-gq5x-r3g9-ch4f
Missing authentication in foreman-tasks
Priority LOW 32
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7.
TI-2016-08558 CVE-2016-10516 · GHSA-h2fp-xgx6-xh6f
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py…
Priority LOW 31
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject…
TI-2019-02902 CVE-2019-3893 · GHSA-xfjc-qf4h-hwgq
Incorrect permission assignment in foreman
Priority LOW 26
In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource.
TI-2019-11030 CVE-2019-14825 · GHSA-m4wh-848j-9w2r
Cleartext storage of sensitive information in Red Hat katello
Priority LOW 15
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9.