suse/venv-openstack-heat&distro=HPE Helion OpenStack 8

Vulnerabilities (150)

• CVE-2020-11110Jul 27, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

• CVE-2020-10177Jun 25, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

• CVE-2020-10994Jun 25, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

• CVE-2020-10378Jun 25, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

• CVE-2020-13379Jun 3, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information abo

• CVE-2020-13596Jun 3, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

• CVE-2020-13254Jun 3, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

• CVE-2018-18625Jun 2, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

• CVE-2018-18624Jun 2, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

• CVE-2018-18623Jun 2, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

• CVE-2020-11077May 22, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mis

• CVE-2020-11076May 22, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

• CVE-2020-10744May 15, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18

• CVE-2020-1746May 12, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are use

• CVE-2020-8151May 12, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.

• CVE-2020-10685May 11, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble,

• CVE-2020-10691Apr 30, 2020
  affected < 9.0.8~dev22-12.29.1fixed 9.0.8~dev22-12.29.1

  An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwr

• CVE-2020-10663Apr 28, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically,

• CVE-2020-12052Apr 27, 2020
  affected < 9.0.8~dev22-12.27.1fixed 9.0.8~dev22-12.27.1

  Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

• CVE-2018-17954Apr 3, 2020
  affected < 9.0.8~dev22-12.23.2fixed 9.0.8~dev22-12.23.2

  An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue a