Pcs
by Clusterlabs
Source repositories
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-0720 | Hig | 0.50 | 8.8 | 0.01 | Apr 21, 2017 | Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. | ||
| CVE-2016-0721 | Hig | 0.46 | 8.1 | 0.02 | Apr 21, 2017 | Session fixation vulnerability in pcsd in pcs before 0.9.157. | ||
| CVE-2023-2319 | 0.00 | — | 0.01 | May 17, 2023 | It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via… | |||
| CVE-2022-2735 | 0.00 | — | 0.00 | Sep 6, 2022 | A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster"… | |||
| CVE-2022-1049 | 0.00 | — | 0.02 | Mar 25, 2022 | A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login. | |||
| CVE-2017-2661 | Med | 0.00 | 6.1 | 0.01 | Mar 12, 2018 | ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster. | ||
| CVE-2015-3983 | 0.00 | — | 0.02 | May 14, 2015 | The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per… | |||
| CVE-2015-1848 | 0.00 | — | 0.02 | May 14, 2015 | The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to… |
- risk 0.50cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
- risk 0.46cvss 8.1epss 0.02
Session fixation vulnerability in pcsd in pcs before 0.9.157.
- CVE-2023-2319May 17, 2023risk 0.00cvss —epss 0.01
It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via…
- CVE-2022-2735Sep 6, 2022risk 0.00cvss —epss 0.00
A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster"…
- CVE-2022-1049Mar 25, 2022risk 0.00cvss —epss 0.02
A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.
- risk 0.00cvss 6.1epss 0.01
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- CVE-2015-3983May 14, 2015risk 0.00cvss —epss 0.02
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per…
- CVE-2015-1848May 14, 2015risk 0.00cvss —epss 0.02
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to…