CVSS: 4.3EPSS: 1%CPEs: 4EXPL: 0CVE-2009-2696 – tomcat: missing fix for CVE-2009-0781
https://notcve.org/view.php?id=CVE-2009-2696
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en jsp/cal/cal2.jsp en la aplicación calendario en los ejemplos de aplicaciones web de Apache Tomcat en Red Hat Enterprise Linux v5, Desktop Workstation v5, y Linux Desktop v5 permite a atacantes remotos injectar código web o HTML a través de parámetros de tiempo, relacionados con "HTML no válido". NOTA: se debe a una corrección que falta para CVE-2009-0.781. • http://secunia.com/advisories/40813 http://www.redhat.com/support/errata/RHSA-2010-0580.html http://www.vupen.com/english/advisories/2010/1986 https://bugzilla.redhat.com/show_bug.cgi?id=616717 https://access.redhat.com/security/cve/CVE-2009-2696 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 28EXPL: 1CVE-2010-2526 – lvm2-cluster: insecurity when communicating between lvm2 and clvmd
https://notcve.org/view.php?id=CVE-2010-2526
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands. El cluster logical volume manager daemon (clvmd) en lvm2-cluster en LVM2 anterior v2.02.72, como el usado en Red Hat Global File System (GFS) y otros productos, no verifica las credenciales de cliente sobre una conexión socket, permitiendo a usuarios locales causar una denegación de servicio (cuelgue del demonio o cambio de volumen lógico) o probablemente tener otros impactos a través de comandos de control manipulados. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://secunia.com/advisories/40759 http://securitytracker.com/id?1024258 http://www.osvdb.org/66753 http://www.ubuntu.com/usn/USN-1001-1 http://www.vupen.com/english/advisories/2010/1944 https://bugzilla.redhat.com/show_bug.cgi?id=614248 https://exchange.xforce.ibmcloud.com/vulnerabilities/60809 https://rhn.redhat.com/errata/RHSA-2010-0567.html https://rhn.redhat.com/errata/RHSA-2010-0568.html htt • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 96%CPEs: 6EXPL: 1CVE-2010-1871 – Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1871
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured. JBoss Seam 2 (jboss-seam2), como el usado en JBoss Enterprise Application Platform v4.3.0 para Red Hat Linux, no sanea adecuadamente las entradas de de la expresiones de Expression LanguageJBoss Expression Language (EL), lo que permite a atacantes remotos ejecutar código de su elección a través de URL manipuladas. NOTA: Solo se da esta vulnerabilidad cuando el Java Security Manager no está configurado adecuadamente. JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. • https://www.exploit-db.com/exploits/36653 http://archives.neohapsis.com/archives/bugtraq/2013-05/0117.html http://www.redhat.com/support/errata/RHSA-2010-0564.html http://www.securityfocus.com/bid/41994 http://www.securitytracker.com/id?1024253 http://www.vupen.com/english/advisories/2010/1929 https://bugzilla.redhat.com/show_bug.cgi?id=615956 https://exchange.xforce.ibmcloud.com/vulnerabilities/60794 https://security.netapp.com/advisory/ntap-20161017-0001 https://access.redhat. • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 4.6EPSS: 0%CPEs: 6EXPL: 0CVE-2010-1439 – rhn-client-tools: authorized information disclosure
https://notcve.org/view.php?id=CVE-2010-1439
yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file. yum-rhn-plugin en Red Hat Network Client Tools (también conocido como rhn-client-tools) en Red Hat Enterprise Linux (RHEL) v5 y Fedora utiliza permisos de lectura para todo el mundo (world-readable) para el archivo /var/spool/up2date/loginAuth.pkl, lo que permite a usuarios locales acceder al perfil Red Hat Network, y posiblemente prevenir futuras actualizaciones de seguridad, aprovechando los datos de autenticación de este archivo. • http://secunia.com/advisories/39996 http://securitytracker.com/id?1024049 http://www.osvdb.org/65063 http://www.redhat.com/support/errata/RHSA-2010-0449.html http://www.securityfocus.com/bid/40492 http://www.vupen.com/english/advisories/2010/1311 https://bugzilla.redhat.com/show_bug.cgi?id=585386 https://exchange.xforce.ibmcloud.com/vulnerabilities/59114 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9232 https://access.redhat.com/security/cv • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.7EPSS: 1%CPEs: 9EXPL: 0CVE-2010-0730 – xen: emulator instruction decoding inconsistency
https://notcve.org/view.php?id=CVE-2010-0730
The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation. El decodificador de instrucciones MMIO en el hipervisor Xen en el kernel Linux 2.6.18 en Red Hat Enterprise Linux (RHEL) 5 permite a los usuarios de los sistemas operativos huesped causar una denegación de servicio (cuelgue de sistema operativo huesped de 32-bit) a través de vectores que provocan una emulación de la instrucción sin especificar. • http://secunia.com/advisories/39649 http://secunia.com/advisories/43315 http://support.avaya.com/css/P8/documents/100088287 http://www.openwall.com/lists/oss-security/2010/05/07/1 http://www.redhat.com/support/errata/RHSA-2010-0398.html http://www.securityfocus.com/archive/1/516397/100/0/threaded http://www.securityfocus.com/bid/39979 http://www.vmware.com/security/advisories/VMSA-2011-0003.html https://bugzilla.redhat.com/show_bug.cgi?id=572971 https://oval.cise • CWE-20: Improper Input Validation •