Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-1720 State: PUBLISHED Published: 2020-03-17T15:28:24 Last Updated: 2024-08-04T06:46:30.847Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: postgresql Problem Types: CWE-285 Description: A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17. Additional Analyst Notes: - CVE Program Container: References:
before 12.2, before 11.7, before 10.12 and before 9.6.17. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720 - https://www.postgresql.org/about/news/2011/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html
CVE ID: CVE-2020-1721 State: PUBLISHED Published: 2021-04-30T11:04:01 Last Updated: 2024-08-04T06:46:30.633Z Vendors: n/a Products: pki-core Problem Types: CWE-79 Description: A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1777579
CVE ID: CVE-2020-1722 State: PUBLISHED Published: 2020-04-27T20:46:52 Last Updated: 2024-08-04T06:46:30.371Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: ipa Problem Types: CWE-400 Description: A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-17
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1722
CVE ID: CVE-2020-1723 State: PUBLISHED Published: 2021-01-28T19:07:41 Last Updated: 2024-08-04T06:46:30.868Z Vendors: Louketo Products: Keycloak Gatekeeper Problem Types: CWE-601 Description: A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper (Louketo): 6.0.1, 7.0.0 Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1770276 - https://issues.redhat.com/browse/KEYCLOAK-11318
CVE ID: CVE-2020-1724 State: PUBLISHED Published: 2020-05-11T20:10:24 Last Updated: 2024-08-04T06:46:30.888Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-613 Description: A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1724
CVE ID: CVE-2020-1725 State: PUBLISHED Published: 2021-01-28T19:05:16 Last Updated: 2024-08-04T06:46:30.455Z Vendors: n/a Products: keycloak Problem Types: CWE-863 Description: A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token. Additional Analyst Notes: - CVE Program Container: References: - https://issues.redhat.com/browse/KEYCLOAK-16550 - https://bugzilla.redhat.com/show_bug.cgi?id=1765129
CVE ID: CVE-2020-1726 State: PUBLISHED Published: 2020-02-11T19:45:26 Last Updated: 2024-08-04T06:46:30.890Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: The Products: podman Problem Types: CWE-552 Description: A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. Additional Analyst Notes: - CVE Progra
law and overwrite files in the volume.This issue was introduced in version 1.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726 - https://access.redhat.com/errata/RHSA-2020:0680 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html
CVE ID: CVE-2020-1727 State: PUBLISHED Published: 2020-06-22T17:46:54 Last Updated: 2024-08-04T06:46:30.851Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: keycloak Problem Types: CWE-20 Description: A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1727
CVE ID: CVE-2020-1728 State: PUBLISHED Published: 2020-04-06T13:04:23 Last Updated: 2024-08-04T06:46:30.949Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: keycloak Problem Types: CWE-358 Description: A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vec
ssarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1728
CVE ID: CVE-2020-1729 State: PUBLISHED Published: 2021-05-28T13:09:43 Last Updated: 2024-08-04T06:46:30.150Z Vendors: n/a Products: SmallRye Problem Types: CWE-863 Description: A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2 Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1802444
CVE ID: CVE-2020-1730 State: PUBLISHED Published: 2020-04-13T00:00:00 Last Updated: 2024-08-04T06:46:30.844Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: libssh Problem Types: CWE-476 Description: A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject
ity is system availability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLSWHBQ3EPKGTGLQNH554Z746BJ3C554/ - https://usn.ubuntu.com/4327-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2A7BIFKUYIYKTY7FX4BEWVC2OHS5DPOU/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.libssh.org/security/advisories/CVE-2020-1730.txt - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1730 - https://security.netapp.com/advisory/ntap-20200424-0001/
CVE ID: CVE-2020-1731 State: PUBLISHED Published: 2020-03-02T16:22:36 Last Updated: 2024-08-04T06:46:30.501Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Red Hat Products: keycloak Problem Types: CWE-341 Description: A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1731
CVE ID: CVE-2020-1732 State: PUBLISHED Published: 2020-05-04T16:43:21 Last Updated: 2024-08-04T06:46:30.866Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Soteria Problem Types: CWE-284 Description: A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1732 - https://github.com/wildfly
Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1732 - https://github.com/wildfly-security/soteria/commit/c2479f8c39d7d661341fdcaff7f5e97c5eea1a54
CVE ID: CVE-2020-1733 State: PUBLISHED Published: 2020-03-11T18:47:40 Last Updated: 2024-08-04T06:46:30.850Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: Ansible Problem Types: CWE-377 Description: A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to g
ration does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733 - https://github.com/ansible/ansible/issues/67791 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org
t/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2020-1734 State: PUBLISHED Published: 2020-03-03T21:23:15 Last Updated: 2024-08-04T06:46:30.815Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Red Hat Products: Ansible Problem Types: CWE-78 Description: A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734
itional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734 - https://github.com/ansible/ansible/issues/67792
CVE ID: CVE-2020-1735 State: PUBLISHED Published: 2020-03-16T15:05:04 Last Updated: 2024-08-04T06:46:30.837Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: ansible Problem Types: CWE-22 Description: A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1735 - https://github.com/ansible/ansible/issues/67793 - ht
nces: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1735 - https://github.com/ansible/ansible/issues/67793 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2020-1736 State: PUBLISHED Published: 2020-03-16T15:03:52 Last Updated: 2024-08-04T06:46:30.890Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: ansible Problem Types: CWE-732 Description: A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Additi
the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736 - https://github.com/ansible/ansible/issues/67794 - https://security.gentoo.org/glsa/202006-11 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7/
CVE ID: CVE-2020-1737 State: PUBLISHED Published: 2020-03-09T15:11:38 Last Updated: 2024-08-04T06:46:30.898Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Ansible Problem Types: CWE-22 Description: A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10. Additional Analyst Notes: - CVE Program Container: References: - https:
g a path traversal. This issue is fixed in 2.10. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737 - https://github.com/ansible/ansible/issues/67795 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/ - https://security.gentoo.org/glsa/202006-11
CVE ID: CVE-2020-1738 State: PUBLISHED Published: 2020-03-16T15:08:03 Last Updated: 2024-08-04T06:46:31.069Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L) Vendors: Red Hat Products: ansible Problem Types: CWE-88 Description: A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-17
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738 - https://github.com/ansible/ansible/issues/67796 - https://security.gentoo.org/glsa/202006-11
CVE ID: CVE-2020-1739 State: PUBLISHED Published: 2020-03-12T17:47:19 Last Updated: 2024-08-04T06:46:30.852Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Ansible Problem Types: CWE-200 Description: A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739 - https://github.com/ansible/ansible/issues/67797 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2020-1740 State: PUBLISHED Published: 2020-03-16T15:07:11 Last Updated: 2024-08-04T06:46:30.903Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: ansible Problem Types: CWE-377 Description: A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions i
write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740 - https://github.com/ansible/ansible/issues/67798 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
g/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ - https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950
CVE ID: CVE-2020-1741 State: PUBLISHED Published: 2020-04-24T18:34:07 Last Updated: 2024-08-04T06:46:30.884Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: openshift-ansible Problem Types: CWE-185 Description: A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality. Additional Analyst Notes: - CVE Program Container:
ck. The main threat from this vulnerability is data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1741
CVE ID: CVE-2020-1742 State: PUBLISHED Published: 2021-06-07T19:52:30 Last Updated: 2024-08-04T06:46:30.869Z Vendors: n/a Products: nmstate/kubernetes-nmstate-handler Problem Types: CWE-266 Description: An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1803608
CVE ID: CVE-2020-1744 State: PUBLISHED Published: 2020-03-24T00:00:00 Last Updated: 2024-08-04T06:46:30.879Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: keycloak Problem Types: CWE-755 Description: A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1744 - https://access.redhat.com/security/
Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1744 - https://access.redhat.com/security/cve/CVE-2020-1744
CVE ID: CVE-2020-1745 State: PUBLISHED Published: 2020-04-28T00:00:00 Last Updated: 2024-08-04T06:46:30.867Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: undertow-io Products: undertow Problem Types: CWE-285 Description: A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code with