CVSS: 7.8EPSS: 0%CPEs: 22EXPL: 0CVE-2011-4930 – Condor: Multiple format string flaws
https://notcve.org/view.php?id=CVE-2011-4930
10 Feb 2014 — Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors. Múltiples vulnerabilidades de cade... • http://research.cs.wisc.edu/htcondor/security/vulnerabilities/CONDOR-2012-0001.html • CWE-134: Use of Externally-Controlled Format String •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-4179 – plugin: enable QUEUE_ALL_USERS_TRUSTED for Submit/Hold/Release/Remove ops
https://notcve.org/view.php?id=CVE-2010-4179
07 Dec 2010 — The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid (MRG) 1.3 recommends that Condor should be configured so that the MRG Management Console (cumin) can submit jobs for users, which creates a trusted channel with insufficient access control that allows local users with the ability to publish to a broker to run jobs as arbitrary users via Condor QMF plug-ins. La documentación de instalación de Red Hat Enterprise Messaging, Realtime and Grid (MRG) v1.3 recomienda que Condor debe... • http://secunia.com/advisories/42406 • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •