Canonical

Records4302All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical587CVSS 9.0–10.0

CVSS high1486CVSS 7.0–8.9

Exploited now

Canonical records in CISA KEV

Products in the NVD configurations · select one to filter the records

5 records in Metal As A Service · all components

TI-2024-05658 CVE-2024-6107 · GHSA-525h-hfxr-w785

HIGH 75

Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00418 Published 2025-07-21 Fixed in 3.1.4, 3.2.11 +3 CWE-287

TI-2015-01199 CVE-2015-1320 · GHSA-rh3g-x45r-f376

MEDIUM 44

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0087 Published 2019-04-22 Fixed in 1.9.2 CWE-255

TI-2014-01105 CVE-2014-1427 · GHSA-r5fr-m3x2-j65q

MEDIUM 43

A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting.

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.01088 Published 2019-04-22 Fixed in 1.9.2 CWE-79

TI-2014-01104 CVE-2014-1426 · GHSA-8cwf-xm55-w837

MEDIUM 40

A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.01408 Published 2019-04-22 Fixed in 1.9.2 CWE-20

TI-2014-01106 CVE-2014-1428 · GHSA-qq47-q6fw-c7qm

LOW 26

A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.00948 Published 2019-04-22 Fixed in 1.9.2 CWE-254