Skip to content
Noroxi

pulpproject records

15 published records for vendor pulpproject.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
60%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 22
  4. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

15 records
  • CVE-2024-7143
    33Monitor

    Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

    HighCVSS 8.3No exploitEPSS 1%

    pulpproject · pulpAug 7, 2024

  • CVE-2015-5263
    32Monitor

    pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon

    HighCVSS 8.1No exploitEPSS 1%

    pulpproject · pulpSep 25, 2017

  • CVE-2016-3112
    31Monitor

    client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which

    HighCVSS 7.5No exploitEPSS 2%

    pulpproject · pulpJun 8, 2017

  • CVE-2016-3704
    31Monitor

    Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.

    HighCVSS 7.5No exploitEPSS 2%

    fedoraproject · fedoraJun 13, 2017

  • CVE-2018-1090
    30Monitor

    In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with rea

    HighCVSS 7.5No exploitEPSS 1%

    pulpproject · pulpJun 18, 2018

  • CVE-2013-7450
    30Monitor

    Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.

    HighCVSS 7.5No exploitEPSS 1%

    pulpproject · pulpApr 3, 2017

  • CVE-2015-5164
    29Monitor

    The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative

    HighCVSS 7.2No exploitEPSS 4%

    pulpproject · qpidOct 18, 2017

  • CVE-2016-3108
    28Monitor

    The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink att

    HighCVSS 7.1No exploitEPSS 0%

    pulpproject · pulpJun 8, 2017

  • CVE-2018-10917
    26Monitor

    pulp 2.16.x and possibly older is vulnerable to an improper path parsing.

    MediumCVSS 6.5No exploitEPSS 1%

    pulpproject · pulpAug 15, 2018

  • CVE-2016-3111
    22Monitor

    pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp

    MediumCVSS 5.5No exploitEPSS 0%

    pulpproject · pulpJun 8, 2017

  • CVE-2016-3696
    22Monitor

    The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.

    MediumCVSS 5.5No exploitEPSS 0%

    fedoraproject · fedoraJun 13, 2017

  • CVE-2016-3095
    22Monitor

    server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.

    MediumCVSS 5.5No exploitEPSS 0%

    fedoraproject · fedoraJun 8, 2017

  • CVE-2022-3644
    22Monitor

    The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mod

    MediumCVSS 5.5No exploitEPSS 0%

    pulpproject · pulp ansibleOct 25, 2022

  • CVE-2016-3107
    22Monitor

    The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" dir

    MediumCVSS 5.5No exploitEPSS 0%

    pulpproject · pulpJun 8, 2017

  • CVE-2016-3106
    21Monitor

    Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.

    MediumCVSS 5.3No exploitEPSS 1%

    pulpproject · pulpApr 13, 2017