Priority LOW 28
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than characte…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00493 · Published 2024-11-07 · Partial fix · 6.2.0.Final CWE-79
Priority LOW 35
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00392 · Published 2024-08-21 · Partial fix · 15.4.1-17.1.20240911093743.e5b18f2.el8ost, 16.5.1-17.1.20240913093745.f3599d0.el8ost +2 CWE-295
Priority LOW 23
An incomplete fix for CVE-2023-1625 was found in openstack-heat.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.00394 · Published 2024-08-02 · No fix listed CWE-200
Priority LOW 26
An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00201 · Published 2024-03-15 · Partial fix · 14.3.1-17.1.20231103003762.el8ost, 3.3.1-17.1.20231101233754.el8ost +2 CWE-1220
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.93547 · Published 2023-12-18 · Partial fix · 0.40.2, 0.17.0 +2 CWE-354
Priority MEDIUM 41
A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0098 · Published 2023-11-01 · Fixed in 0.30.2-4.el9, 0.30.2-4.el8ost +1 CWE-770
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority LOW 29
A credentials leak flaw was found in OpenStack Barbican.
CVSS 3.1MEDIUM 6.6· Local · Low privileges · No interaction · EPSS 0.00193 · Published 2023-09-24 · Partial fix CWE-200
Priority LOW 27
A vulnerability was found in OpenStack Barbican containers.
CVSS 3.1MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00484 · Published 2023-09-24 · No fix listed CWE-653
Priority HIGH 66
An information leak was discovered in OpenStack heat.
CVSS 3.1HIGH 7.4· Network · Low privileges · No interaction · EPSS 0.00715 · Published 2023-09-24 · Partial fix · 20.0.0 CWE-202
Priority LOW 35
An information leak was found in OpenStack's undercloud.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01107 · Published 2023-09-20 · Fixed in 8.4.9-13.el7ost CWE-402
Priority LOW 33
A flaw was found in OpenStack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00292 · Published 2023-09-15 · No fix listed CWE-256
Priority LOW 36
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01771 · Published 2023-09-14 · Partial fix · 2.3.5, 2.2.24 +18 CWE-835
Priority LOW 31
An uncontrolled resource consumption flaw was found in openstack-neutron.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01305 · Published 2023-07-25 · Partial fix · 1:15.3.5-2.20230216175503.el8ost CWE-400
Priority LOW 36
A flaw was found in the QEMU built-in VNC server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01606 · Published 2023-07-11 · Partial fix CWE-476
Priority MEDIUM 44
A flaw was found in openvswitch (OVS).
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.01216 · Published 2023-04-10 · Partial fix CWE-670
Priority MEDIUM 62
An uncontrolled resource consumption flaw was found in openstack-neutron.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01065 · Published 2023-03-06 · Partial fix · 19.5.0, 18.6.0 +1 CWE-400
Priority LOW 27
A flaw was found in the openstack-barbican component.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00449 · Published 2023-01-18 · Fixed CWE-305
Priority LOW 38
An authorization flaw was found in openstack-barbican.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0128 · Published 2022-09-06 · Partial fix · 14.0.0 CWE-863
Priority LOW 25
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01294 · Published 2022-09-01 · Partial fix · 14.0.0 CWE-863
Priority LOW 30
A flaw was found in Keystone.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00719 · Published 2022-09-01 · No fix listed CWE-324
Priority MEDIUM 42
A permissive list of allowed inputs flaw was found in DPDK.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.02389 · Published 2022-08-31 · Partial fix CWE-791
Priority LOW 26
A flaw was found in python-oslo-utils.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01859 · Published 2022-08-29 · Partial fix · 4.10.1 CWE-522
Priority LOW 36
A flaw was found in openstack-keystone.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01863 · Published 2022-08-26 · No fix listed CWE-863
Priority LOW 30
A key length flaw was found in Red Hat Ceph Storage.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00597 · Published 2022-08-25 · Partial fix CWE-327
Load more
THREATIST.IORead the docs