CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2013-7489
https://notcve.org/view.php?id=CVE-2013-7489
The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution. La biblioteca Beaker versiones hasta 1.11.0 para Python, está afectada por una deserialización de datos no confiables, lo que podría conllevar a una ejecución de código arbitraria • https://bugzilla.redhat.com/show_bug.cgi?id=1850105 https://github.com/bbangert/beaker/issues/191 https://www.openwall.com/lists/oss-security/2020/05/14/11 • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12079
https://notcve.org/view.php?id=CVE-2020-12079
Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API. Beaker versiones anteriores a 0.8.9, permite un escape del sandbox, permitiendo acceso al sistema y una ejecución de código. Esto ocurre porque no es usado el aislamiento de contexto de Electron y, por lo tanto, un atacante puede conducir un ataque de contaminación de prototipo contra la API de mensajería interna de Electron. • https://github.com/beakerbrowser/beaker/issues/1519 https://github.com/beakerbrowser/beaker/releases/tag/0.8.9 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3160
https://notcve.org/view.php?id=CVE-2015-3160
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system. Una vulnerabilidad de tipo XML External Entity (XXE) en bkr/server/jobs.py en versiones de Beaker anteriores a la 20.1 permite que usuarios remotos autenticados obtengan información sensible enviando una tarea en formato XML al servidor que haga referencia a archivos desde el sistema de archivos del servidor de Beaker. • http://www.openwall.com/lists/oss-security/2015/05/08/1 http://www.securityfocus.com/bid/74569 https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1 https://bugzilla.redhat.com/attachment.cgi?id=1020003 https://bugzilla.redhat.com/show_bug.cgi?id=1215020 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2015-3163
https://notcve.org/view.php?id=CVE-2015-3163
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively. Las páginas de administrador para tipos de poderes y de claves en versiones de Beaker anteriores a la 20.1 no tienen ningún control de acceso. Esto permite que atacantes remotos autenticados modifiquen tipos de poderes y tipos de claves navegando a $BEAKER/powertypes and $BEAKER/keytypes respectivamente. • http://www.openwall.com/lists/oss-security/2015/05/08/1 http://www.securityfocus.com/bid/74567 https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html https://bugzilla.redhat.com/show_bug.cgi?id=1215034 • CWE-284: Improper Access Control •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3161
https://notcve.org/view.php?id=CVE-2015-3161
The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON. El código fuente de la barra de búsqueda en bkr/server/widgets.py en versiones de Beaker anteriores a la 20.1 no escapa etiquetas en literales de cadena cuando se crean archivos de tipo JSON. • http://www.openwall.com/lists/oss-security/2015/05/08/1 http://www.securityfocus.com/bid/74574 https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html https://bugzilla.redhat.com/attachment.cgi?id=1020004 https://bugzilla.redhat.com/show_bug.cgi?id=1215024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •