Advisory Catalog

Ansible apt_key module does not properly verify key fingerprint

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.

PyCA Cryptography vulnerable to GCM tag forgery

Aubio is vulnerable to denial of service via aubio_source_avcodec_readframe function

Aubio is vulnerable to denial of service via aubio_pitch_set_unit function

Aubio is vulnerable to out of bound read when samplerate > 50kHz

OpenStack Identity service (keystone) Incorrect Authorization

Ansible Arbitrary Code Execution

Qutebrowser CSRF Vulnerability

Mercurial Improper Input Validation vulnerability

Mercurial Improper Input Validation vulnerability

Ansible exposes sensitive data in log files and on the terminal

Ansible Improper Input Validation vulnerability

websockets is vulnerable to denial of service by memory exhaustion

aiohttp-session Session Fixation vulnerability

Topydo Improper Input Validation vulnerability

Ansible Arbitrary Code Execution

Matrix Synapse Authorization Error

Yelp OSXCollector Improper Certificate Validation

Matrix Synapse Security Filtering Flaw

oslo.middleware Information Disclosure vulnerability

Matrix Synapse DoS

tlslite-ng off-by-one error on mac checking

Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers

OISF suricata-update unsafely deserializes YAML data

Tryton vulnerable to arbitrary command execution

JSNAPy allows unprivileged local users to alter files under the directory

Kotti CSRF in the local roles implementation

Jupyter Notebook file bypasses sanitization, executes JavaScript

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application.

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter ..

Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that can result in Code execution on the server . This attack appear to be exploitable via Being a CSRF, victim interaction is needed, when the vic

Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.

uWSGI Directory Traversal vulnerability

OpenStack Nova Denial of service attack on the compute host

JupyterHub OAuthenticator elevation of privilege

Borg Improper Access Control vulnerability

Django vulnerable to information leakage in AuthenticationForm

Pycrypto generates weak key parameters

keycloak-httpd-client-install Insecure Secrets

Arbitrary file write in NumPy

Numpy arbitrary file write via symlink attack

Plone Unauthorized Access Vulnerability

Integer Overflow or Wraparound in OpenCV.

Out-of-bounds Read in OpenCV

Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks

OpenStack Nova DoS by rebuilding the same instance with a new image multiple times

Aubio Divide-By-Zero DoS vulnerability in new_aubio_source_wavread function

Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

Sanic arbitrary file read and directory traversal