CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-4364
https://notcve.org/view.php?id=CVE-2013-4364
(1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp. (1) oo-analytics-export y (2) oo-analytics-import en el paquete openshift-origin-broker-util en Red Hat OpenShift Enterprise 1 y 2 permiten que los usuarios locales provoquen un impacto sin especificar mediante un ataque symlink en un archivo no especificado en /tmp. • https://bugzilla.redhat.com/show_bug.cgi?id=1009734 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0238
https://notcve.org/view.php?id=CVE-2015-0238
selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. selinux-policy tal y como está incluido en Red Hat OpenShift 2 permite que los atacantes obtengan información de la lista de procesos mediante un ataque de escalado de privilegios. • https://access.redhat.com/security/cve/CVE-2015-0238 https://bugzilla.redhat.com/show_bug.cgi?id=1184739 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.0EPSS: 0%CPEs: 9EXPL: 0CVE-2017-1000376
https://notcve.org/view.php?id=CVE-2017-1000376
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1. libffi solicita una pila ejecutable que permite que los atacantes desencadenen con más facilidad la ejecución de código arbitrario sobrescribiendo la pila. Se debe tener en cuenta que libffi es empleado por otras bibliotecas. Antes se dijo que esto afecta a la versión 3.2.1 de libffi, pero parece ser incorrecto. libffi en versiones anteriores a la 3.1 en sistemas x86 de 32 bits era vulnerable y se cree que upstream ha solucionado este problema en la versión 3.1. • http://www.debian.org/security/2017/dsa-3889 https://access.redhat.com/security/cve/CVE-2017-1000376 https://www.oracle.com/security-alerts/cpujan2020.html https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5409
https://notcve.org/view.php?id=CVE-2016-5409
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies. Red Hat OpenShift Enterprise 2 no incluye el indicador HTTPOnly en el encabezado Set-Cookie para la cookie GEARID, lo que hace más fácil para el atacante remoto obtener información potencialmente sensible a través del acceso con secuencias de comandos a los cookies. • http://www.securityfocus.com/bid/97988 https://bugzilla.redhat.com/show_bug.cgi?id=1366461 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2016-1000229 – swagger-ui: cross-site scripting in key names
https://notcve.org/view.php?id=CVE-2016-1000229
swagger-ui has XSS in key names swagger-ui presenta una vulnerabilidad de tipo XSS en nombres claves. It was found that swagger-ui contains a cross site scripting (XSS) vulnerability in the key names in the JSON document. An attacker could use this flaw to supply a key name with script tags which could cause arbitrary code execution. Additionally it is possible to load the arbitrary JSON files remotely via the URL query-string parameter. • https://github.com/ossf-cve-benchmark/CVE-2016-1000229 http://www.securityfocus.com/bid/97580 https://access.redhat.com/errata/RHSA-2017:0868 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229 https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json https://access.redhat.com/security/cve/CVE-2016-1000229 https://bugzilla.redhat.com/show_bug.cgi?id=1360275 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •