CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-7561
https://notcve.org/view.php?id=CVE-2015-7561
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. Kubernetes en OpenShift3 permite que atacantes remotos autenticados empleen las imágenes privadas de otros usuarios si conocen el nombre de dicha imagen. • https://bugzilla.redhat.com/show_bug.cgi?id=1291963 https://github.com/kubernetes/kubernetes/pull/18909 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.0EPSS: 0%CPEs: 9EXPL: 0CVE-2017-1000376
https://notcve.org/view.php?id=CVE-2017-1000376
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1. libffi solicita una pila ejecutable que permite que los atacantes desencadenen con más facilidad la ejecución de código arbitrario sobrescribiendo la pila. Se debe tener en cuenta que libffi es empleado por otras bibliotecas. Antes se dijo que esto afecta a la versión 3.2.1 de libffi, pero parece ser incorrecto. libffi en versiones anteriores a la 3.1 en sistemas x86 de 32 bits era vulnerable y se cree que upstream ha solucionado este problema en la versión 3.1. • http://www.debian.org/security/2017/dsa-3889 https://access.redhat.com/security/cve/CVE-2017-1000376 https://www.oracle.com/security-alerts/cpujan2020.html https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5409
https://notcve.org/view.php?id=CVE-2016-5409
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies. Red Hat OpenShift Enterprise 2 no incluye el indicador HTTPOnly en el encabezado Set-Cookie para la cookie GEARID, lo que hace más fácil para el atacante remoto obtener información potencialmente sensible a través del acceso con secuencias de comandos a los cookies. • http://www.securityfocus.com/bid/97988 https://bugzilla.redhat.com/show_bug.cgi?id=1366461 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2016-1000229 – swagger-ui: cross-site scripting in key names
https://notcve.org/view.php?id=CVE-2016-1000229
swagger-ui has XSS in key names swagger-ui presenta una vulnerabilidad de tipo XSS en nombres claves. It was found that swagger-ui contains a cross site scripting (XSS) vulnerability in the key names in the JSON document. An attacker could use this flaw to supply a key name with script tags which could cause arbitrary code execution. Additionally it is possible to load the arbitrary JSON files remotely via the URL query-string parameter. • https://github.com/ossf-cve-benchmark/CVE-2016-1000229 http://www.securityfocus.com/bid/97580 https://access.redhat.com/errata/RHSA-2017:0868 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229 https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json https://access.redhat.com/security/cve/CVE-2016-1000229 https://bugzilla.redhat.com/show_bug.cgi?id=1360275 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-8651 – 3: Pulling of any image is possible with it manifest
https://notcve.org/view.php?id=CVE-2016-8651
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image. S ha encontrado un error de validación de entradas en la forma en la que OpenShift 3 gestiona peticiones para imágenes. Un usuario, con una copia del manifiesto asociado con una imagen, puede extraer una imagen incluso aunque normalmente no cuente con acceso a la misma. Esto resulta en la divulgación de información contenida en la imagen. • http://www.securityfocus.com/bid/94935 https://access.redhat.com/errata/RHSA-2016:2915 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651 https://access.redhat.com/security/cve/CVE-2016-8651 https://bugzilla.redhat.com/show_bug.cgi?id=1397987 • CWE-20: Improper Input Validation •