Search
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10863 | 1 Redhat | 1 Certification | 2021-06-04 | 5.0 MEDIUM | 7.5 HIGH |
| It has been discovered that redhat-certification is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory through the /rhcert-transfer URL. An unauthorized attacker may use this flaw to gather sensible information. This flaw affects redhat-certification version 7. | |||||
| CVE-2018-10865 | 1 Redhat | 1 Certification | 2021-06-04 | 5.0 MEDIUM | 7.5 HIGH |
| It has been discovered that redhat-certification does not perform an authorization check and allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system. An attacker could use this flaw to send requests to port 8009 of any host or to keep restarting the RHCertD daemon on a host of another customer. This flaw affects redhat-certification version 7. | |||||
| CVE-2018-10868 | 1 Redhat | 1 Certification | 2021-06-04 | 5.0 MEDIUM | 7.5 HIGH |
| It has been discovered that redhat-certification does not properly limit the number of recursive definitions of entities in XML documents while parsing the status of a host. A remote attacker could use this vulnerability to consume all the memory of the server and cause a Denial of Service. This flaw affects redhat-certification version 7. | |||||
| CVE-2018-10869 | 1 Redhat | 2 Certification, Enterprise Linux | 2019-10-09 | 5.0 MEDIUM | 7.5 HIGH |
| redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd. | |||||