Skip to content
Noroxi

ClusterLabs records

27 published records for vendor clusterlabs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

27 records
  • CVE-2020-35458
    41Plan

    An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x.

    CriticalCVSS 9.8No exploitEPSS 5%

    clusterlabs · hawkJan 12, 2021

  • CVE-2023-39976
    39Monitor

    log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.

    CriticalCVSS 9.8No exploitEPSS 1%

    clusterlabs · libqbAug 8, 2023

  • CVE-2023-2319
    39Monitor

    It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to includ

    CriticalCVSS 9.8No exploitEPSS 0%

    clusterlabs · pcsMay 17, 2023

  • CVE-2022-1049
    36Monitor

    A flaw was found in the Pacemaker configuration tool (pcs).

    HighCVSS 8.8No exploitEPSS 1%

    clusterlabs · pcsMar 25, 2022

  • CVE-2016-0720
    35Monitor

    Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.

    HighCVSS 8.8No exploitEPSS 1%

    clusterlabs · pcsApr 21, 2017

  • CVE-2021-3020
    35Monitor

    An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15.

    HighCVSS 8.8No exploitEPSS 1%

    clusterlabs · hawkAug 25, 2022

  • CVE-2016-0721
    33Monitor

    Session fixation vulnerability in pcsd in pcs before 0.9.157.

    HighCVSS 8.1No exploitEPSS 2%

    clusterlabs · pcsApr 21, 2017

  • CVE-2016-7797
    31Monitor

    Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an

    HighCVSS 7.5No exploitEPSS 3%

    clusterlabs · pacemakerMar 24, 2017

  • CVE-2015-1867
    31Monitor

    Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.

    HighCVSS 7.5No exploitEPSS 3%

    redhat · enterprise linux high availabilityAug 12, 2015

  • CVE-2018-1086
    31Monitor

    pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass.

    HighCVSS 7.5No exploitEPSS 1%

    clusterlabs · pacemaker command line interfaceApr 12, 2018

  • CVE-2019-3885
    31Monitor

    A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be lea

    HighCVSS 7.5No exploitEPSS 1%

    clusterlabs · pacemakerApr 18, 2019

  • CVE-2020-35459
    31Monitor

    An issue was discovered in ClusterLabs crmsh through 4.2.1.

    HighCVSS 7.8No exploitEPSS 0%

    clusterlabs · crmshJan 12, 2021

  • CVE-2016-7035
    31Monitor

    An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface.

    HighCVSS 7.8No exploitEPSS 0%

    clusterlabs · pacemakerSep 10, 2018

  • CVE-2018-16877
    31Monitor

    A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0.

    HighCVSS 7.8No exploitEPSS 0%

    clusterlabs · pacemakerApr 18, 2019

  • CVE-2022-2735
    31Monitor

    A vulnerability was found in the PCS project.

    HighCVSS 7.8No exploitEPSS 0%

    clusterlabs · pcsSep 6, 2022

  • CVE-2020-25654
    29Monitor

    An ACL bypass flaw was found in pacemaker.

    HighCVSS 7.2No exploitEPSS 1%

    clusterlabs · pacemakerNov 24, 2020

  • CVE-2019-12779
    28Monitor

    libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/s

    HighCVSS 7.1No exploitEPSS 0%

    clusterlabs · libqbJun 7, 2019

  • CVE-2022-2553
    26Monitor

    The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node.

    MediumCVSS 6.5No exploitEPSS 1%

    clusterlabs · boothJul 28, 2022

  • CVE-2018-1079
    26Monitor

    pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call.

    MediumCVSS 6.5No exploitEPSS 1%

    clusterlabs · pacemaker command line interfaceApr 12, 2018

  • CVE-2017-2661
    24Monitor

    ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field w

    MediumCVSS 6.1No exploitEPSS 1%

    clusterlabs · pcsMar 12, 2018

  • CVE-2014-0104
    23Monitor

    In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-i

    MediumCVSS 5.9No exploitEPSS 0%

    clusterlabs · fence-agentsJan 2, 2020

  • CVE-2024-3049
    23Monitor

    Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

    MediumCVSS 5.9No exploitEPSS 0%

    clusterlabs · boothJun 6, 2024

  • CVE-2011-5271
    22Monitor

    Pacemaker before 1.1.6 configure script creates temporary files insecurely

    MediumCVSS 5.5No exploitEPSS 0%

    clusterlabs · pacemakerNov 12, 2019

  • CVE-2018-16878
    22Monitor

    A flaw was found in pacemaker up to and including version 2.0.1.

    MediumCVSS 5.5No exploitEPSS 0%

    clusterlabs · pacemakerApr 18, 2019

  • CVE-2010-2496
    22Monitor

    stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access t

    MediumCVSS 5.5No exploitEPSS 0%

    clusterlabs · cluster glueOct 18, 2021