CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3160
https://notcve.org/view.php?id=CVE-2015-3160
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system. Una vulnerabilidad de tipo XML External Entity (XXE) en bkr/server/jobs.py en versiones de Beaker anteriores a la 20.1 permite que usuarios remotos autenticados obtengan información sensible enviando una tarea en formato XML al servidor que haga referencia a archivos desde el sistema de archivos del servidor de Beaker. • http://www.openwall.com/lists/oss-security/2015/05/08/1 http://www.securityfocus.com/bid/74569 https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html#beaker-20-1 https://bugzilla.redhat.com/attachment.cgi?id=1020003 https://bugzilla.redhat.com/show_bug.cgi?id=1215020 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2015-3163
https://notcve.org/view.php?id=CVE-2015-3163
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively. Las páginas de administrador para tipos de poderes y de claves en versiones de Beaker anteriores a la 20.1 no tienen ningún control de acceso. Esto permite que atacantes remotos autenticados modifiquen tipos de poderes y tipos de claves navegando a $BEAKER/powertypes and $BEAKER/keytypes respectivamente. • http://www.openwall.com/lists/oss-security/2015/05/08/1 http://www.securityfocus.com/bid/74567 https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html https://bugzilla.redhat.com/show_bug.cgi?id=1215034 • CWE-284: Improper Access Control •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-3161
https://notcve.org/view.php?id=CVE-2015-3161
The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON. El código fuente de la barra de búsqueda en bkr/server/widgets.py en versiones de Beaker anteriores a la 20.1 no escapa etiquetas en literales de cadena cuando se crean archivos de tipo JSON. • http://www.openwall.com/lists/oss-security/2015/05/08/1 http://www.securityfocus.com/bid/74574 https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html https://bugzilla.redhat.com/attachment.cgi?id=1020004 https://bugzilla.redhat.com/show_bug.cgi?id=1215024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •