CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0186 – EVM: Stored XSS
https://notcve.org/view.php?id=CVE-2013-0186
Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en ManageIQ EVM, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de vectores no especificados. • https://access.redhat.com/errata/RHSA-2014:0215 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0186 https://access.redhat.com/security/cve/CVE-2013-0186 https://bugzilla.redhat.com/show_bug.cgi?id=895346 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 1CVE-2019-16892 – cfme: rubygem-rubyzip denial of service via crafted ZIP file
https://notcve.org/view.php?id=CVE-2019-16892
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption). En Rubyzip versiones anteriores a 1.3.0, un archivo ZIP diseñado puede omitir las comprobaciones de la aplicación en los tamaños de entrada ZIP porque los datos sobre el tamaño sin comprimir pueden ser falsificados. Esto permite a atacantes causar una denegación de servicio (consumo de disco). A vulnerability in Rubyzip, versions prior to 1.3.0, allows a crafted ZIP file to bypass application checks on ZIP entry sizes. • https://access.redhat.com/errata/RHBA-2019:4047 https://access.redhat.com/errata/RHSA-2019:4201 https://github.com/rubyzip/rubyzip/commit/d65fe7bd283ec94f9d6dc7605f61a6b0dd00f55e https://github.com/rubyzip/rubyzip/pull/403 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC https://lists.fedoraproject.org/archives/list/package-announce%40l • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-10854 – cloudforms: stored cross-site scripting in Name field
https://notcve.org/view.php?id=CVE-2018-10854
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field. La versión de Cloudforms, Cloudforms versión 5.8 y Cloudforms versión 5.9, son vulnerables a un ataque de tipo cross-site-scripting. Se encontró un fallo en la funcionalidad de eliminación de mapeo de infraestructura v2v de CloudForms. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10854 https://access.redhat.com/security/cve/CVE-2018-10854 https://bugzilla.redhat.com/show_bug.cgi?id=1590538 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10177
https://notcve.org/view.php?id=CVE-2019-10177
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Se encontró una vulnerabilidad almacenada de cross-site scripting (XSS) en el componente de exportación a PDF de CloudForms, versiones 5.9 y 5.10, debido a que la información del usuario no está correctamente saneada. Un atacante con menos privilegios para editar el proceso puede ejecutar un ataque XSS contra otros usuarios, lo que podría provocar la ejecución de un código malicioso y la extracción del token anti-CSRF de usuarios con privilegios más altos. • http://www.securityfocus.com/bid/109065 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10159 – cfme: Improper authorization in migration log controller allows any user to access VM migration logs
https://notcve.org/view.php?id=CVE-2019-10159
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available. cfme-gemset versión 5.10.4.3 y anteriores, versión 5.9.9.3 y anteriores son vulnerables a un filtrado de datos, debido a una autorización inapropiada en el controlador del registro de migración. Un atacante con acceso a un usuario sin privilegios puede ingresar a todos los registros de migración VM disponibles. A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs available. • https://access.redhat.com/errata/RHSA-2019:2466 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159 https://access.redhat.com/security/cve/CVE-2019-10159 https://bugzilla.redhat.com/show_bug.cgi?id=1718080 • CWE-285: Improper Authorization •