Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: Red Hat Component: 3scale Clear all filters
TI-2021-02745 CVE-2021-3814 · GHSA-46fh-44xx-6xgh

Missing authorization in 3scale

Priority LOW 35

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01158 Published 2022-03-25 Fixed CWE-862
TI-2021-02685 CVE-2021-3752 · GHSA-3f53-58pp-pg79

Use after free in kernel

Priority LOW 35

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition.

CVSS 3.1HIGH 7.1 Adjacent network Low privileges No interaction EPSS 0.01736 Published 2022-02-16 Fixed CWE-416
TI-2021-02378 CVE-2021-3412 · GHSA-jh24-r4rp-jw9m

Missing brute-force protection in 3Scale

Priority LOW 33

It was found that all versions of 3Scale developer portal lacked brute force protections.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0076 Published 2021-06-01 No fix listed CWE-307
TI-2020-15652 CVE-2020-25634 · GHSA-3f3r-g48r-83hh

Improper access control in 3scale-system

Priority LOW 25

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00517 Published 2021-05-26 Partial fix · 3scale-2.10.0-ER1 CWE-284
TI-2020-08610 CVE-2020-10711

NULL pointer dereference in Red Hat Kernel

Priority LOW 32

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03083 Published 2020-05-22 Fixed in 5.7 CWE-476
TI-2019-11053 CVE-2019-14849 · GHSA-8v4x-g74w-cgg6

Cross-site scripting in 3scale

Priority LOW 25

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00528 Published 2019-12-12 Fixed CWE-201