CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-14852
https://notcve.org/view.php?id=CVE-2019-14852
18 Mar 2021 — A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue. Se encontró un fallo en la puerta de enlace de APIcast de 3scale que habilitó el protocolo TLS versión 1.0. Un atacante podría apuntar al tráfico usando este protocolo más débil y romper su cifrado, consiguiend... • https://bugzilla.redhat.com/show_bug.cgi?id=1758208 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20252
https://notcve.org/view.php?id=CVE-2021-20252
23 Feb 2021 — A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability. Se encontró un fallo en Red Hat 3scale API Management Platform versión 2. El backend 3scale no lleva ... • https://bugzilla.redhat.com/show_bug.cgi?id=1928302 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2019-10216 – ghostscript: -dSAFER escape via .buildfont1 (701394)
https://notcve.org/view.php?id=CVE-2019-10216
12 Aug 2019 — In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas. En ghostscript anterior a la versión 9.50, el procedimiento .buildfont1 no aseguraba adecuadamente sus llamadas privilegiadas, permitiendo que los scripts eludieran las restricciones `-dSAFER`. ... • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5b85ddd19 • CWE-648: Incorrect Use of Privileged APIs •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7512 – AMP: validation bypass in oauth
https://notcve.org/view.php?id=CVE-2017-7512
22 Jun 2017 — Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. • https://access.redhat.com/errata/RHSA-2017:1712 • CWE-863: Incorrect Authorization •