CVSS: 5.3EPSS: 0%CPEs: 29EXPL: 0CVE-2018-2797 – OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985)
https://notcve.org/view.php?id=CVE-2018-2797
19 Apr 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) ... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 29EXPL: 0CVE-2018-2798 – OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)
https://notcve.org/view.php?id=CVE-2018-2798
19 Apr 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) ... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.2EPSS: 0%CPEs: 28EXPL: 0CVE-2018-2800 – OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)
https://notcve.org/view.php?id=CVE-2018-2800
19 Apr 2018 — Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to som... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html •
CVSS: 7.4EPSS: 0%CPEs: 19EXPL: 0CVE-2018-2783 – JDK: unspecified vulnerability fixed in 6u191, 7u171, and 8u161 (Security)
https://notcve.org/view.php?id=CVE-2018-2783
19 Apr 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u161 and 8u152; Java SE Embedded: 8u152; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical da... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html •
CVSS: 5.3EPSS: 0%CPEs: 28EXPL: 0CVE-2018-2799 – OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)
https://notcve.org/view.php?id=CVE-2018-2799
19 Apr 2018 — Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Jav... • http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-5382 – Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions
https://notcve.org/view.php?id=CVE-2018-5382
16 Apr 2018 — The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and... • http://www.securityfocus.com/bid/103453 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-354: Improper Validation of Integrity Check Value •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1096 – foreman: SQL injection due to improper handling of the widget id parameter
https://notcve.org/view.php?id=CVE-2018-1096
05 Apr 2018 — An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database. Se ha encontrado un error de saneamiento de entradas en el campo id del controlador del panel de Foreman, en versiones anteriores a la 1.16.1. Un usuario podría emplear este error para realizar un ataque de inyección SQL en la base de datos del backend. An input sanitization flaw was found in the id field of the das... • http://projects.theforeman.org/issues/23028 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1097 – foreman: Ovirt admin password exposed by foreman API
https://notcve.org/view.php?id=CVE-2018-1097
04 Apr 2018 — A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource. Se ha descubierto un problema en versiones anteriores a la 1.16.1 de foreman. El problema permite que usuarios con permisos limitados para encender y apagar hosts oVirt/RHV descubran el nombre de usuario y la contraseña empleados para conectarse al recurso del ordenador. Red Hat Satellite is a systems... • https://access.redhat.com/errata/RHSA-2018:2927 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1077
https://notcve.org/view.php?id=CVE-2018-1077
14 Mar 2018 — Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. Spacewalk 2.6 contiene una API que tiene un error XEE (XML External Entity) que permite la divulgación de información potencialmente sensible del servidor. • https://bugzilla.redhat.com/show_bug.cgi?id=1555429 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15136
https://notcve.org/view.php?id=CVE-2017-15136
27 Feb 2018 — When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered system the previously registered system will lose access to updates including security updates. Al registrar y activar un nuevo sistema en Red Hat Satellite 6, si el nombre de host del nuevo sistema se restablece al nombre de host de un sistema registrado previamente, este sistema anterior perderá el acceso a actualizaciones, incluyendo las de seguridad. • http://www.securityfocus.com/bid/103210 • CWE-20: Improper Input Validation •