Search for packages
| purl | pkg:rpm/redhat/resteasy@2.3.7.2-1.Final_redhat_1.1.ep6?arch=el6 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1yu9-avtx-cybv
Aliases: CVE-2015-1844 |
foreman: API not scoping resources to taxonomies | There are no reported fixed by versions. |
|
VCID-7f1h-1fw8-k7c4
Aliases: CVE-2015-3155 |
foreman: the _session_id cookie is issued without the Secure flag | There are no reported fixed by versions. |
|
VCID-7ghg-a6dy-tkb2
Aliases: CVE-2014-0034 GHSA-38x2-fp9m-87mx |
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token. | There are no reported fixed by versions. |
|
VCID-8wen-twwa-8khm
Aliases: CVE-2014-3653 |
foreman: cross-site scripting (XSS) flaw in template preview screen | There are no reported fixed by versions. |
|
VCID-gbpn-pskk-qbae
Aliases: CVE-2014-0109 GHSA-5wqf-h3r3-gxvh |
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error. | There are no reported fixed by versions. |
|
VCID-m18p-dpdb-skf7
Aliases: CVE-2014-0035 GHSA-v45r-rj5x-hpg2 |
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network. | There are no reported fixed by versions. |
|
VCID-qsde-tz92-xqge
Aliases: CVE-2014-0110 GHSA-5xf9-3v63-ww6f |
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message. | There are no reported fixed by versions. |
|
VCID-rc65-py17-kuhm
Aliases: CVE-2015-1816 |
foreman: lack of SSL certificate validation when performing LDAPS authentication | There are no reported fixed by versions. |
|
VCID-sqjb-qpyd-p7gn
Aliases: CVE-2015-3235 |
foreman: edit_users permission allows changing of admin passwords | There are no reported fixed by versions. |
|
VCID-tbug-mv5x-uucb
Aliases: CVE-2013-4346 GHSA-4433-4cxq-vv73 PYSEC-2014-85 |
The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL. | There are no reported fixed by versions. |
|
VCID-utxw-251d-gfff
Aliases: CVE-2014-3590 |
rhn_satellite_6: cross-site request forgery (CSRF) can force logout | There are no reported fixed by versions. |
|
VCID-wv41-f9qq-xfgs
Aliases: CVE-2014-3481 |
JAX-RS: Information disclosure via XML eXternal Entity (XXE) | There are no reported fixed by versions. |
|
VCID-zkgb-14kz-33dz
Aliases: CVE-2013-4347 GHSA-rv8h-p43r-4x5r PYSEC-2014-86 |
The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||