CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-4253
https://notcve.org/view.php?id=CVE-2013-4253
The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file. El script de despliegue en el conjunto de scripts complementarios "OpenShift Extras" no soportados, en Red Hat Openshift versión 1, instala una clave pública por defecto en el archivo authorized_keys del usuario root • https://github.com/openshift/openshift-extras/blob/enterprise-2.0/README.md#security-notice https://www.openwall.com/lists/oss-security/2014/06/05/19 • CWE-377: Insecure Temporary File CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-4281
https://notcve.org/view.php?id=CVE-2013-4281
In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with local access to the broker to read this file. En Red Hat Openshift versión 1, son aplicados permisos débiles por defecto al archivo /etc/openshift/server_priv.pem en el servidor del broker, lo que podría permitir a usuarios con acceso local al broker leer este archivo • https://github.com/openshift/openshift-extras/blob/enterprise-2.0/README.md#security-notice https://www.openwall.com/lists/oss-security/2014/06/05/19 • CWE-276: Incorrect Default Permissions •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7517
https://notcve.org/view.php?id=CVE-2017-7517
An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance. Se presenta una vulnerabilidad de comprobación de entrada en Openshift Enterprise debido a un mapeo 1:1 de inquilinos en Hawkular Metrics y proyectos/espacios de nombres en OpenShift. Si un usuario crea un proyecto llamado "MyProject", y más tarde lo elimina, otro usuario puede crear un proyecto llamado "MyProject" y acceder a las métricas almacenadas de la instancia original "MyProject" • https://access.redhat.com/security/cve/CVE-2017-7517 https://bugzilla.redhat.com/show_bug.cgi?id=1470414 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0068
https://notcve.org/view.php?id=CVE-2014-0068
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission. Se ha reportado que watchman en openshift node-utils crea /var/run/watchman.pid y /var/log/watchman.ouput con permiso de escritura mundial • https://bugzilla.redhat.com/show_bug.cgi?id=1064100 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 41EXPL: 0CVE-2021-3695 – grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap
https://notcve.org/view.php?id=CVE-2021-3695
A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12. Una imagen PNG en escala de grises de 16 bits diseñada puede conllevar a una escritura fuera de límites en el área de la pila. • https://bugzilla.redhat.com/show_bug.cgi?id=1991685 https://security.gentoo.org/glsa/202209-12 https://security.netapp.com/advisory/ntap-20220930-0001 https://access.redhat.com/security/cve/CVE-2021-3695 • CWE-787: Out-of-bounds Write •