Vulnerabilites related to redhat - conga
CVE-2013-7347 (GCVE-0-2013-7347)
Vulnerability from cvelistv5
Published
2014-03-30 00:00
Modified
2024-08-06 18:01
Severity ?
CWE
  • n/a
Summary
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:01:20.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
          },
          {
            "name": "RHSA-2013:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-01-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-03-30T00:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
        },
        {
          "name": "RHSA-2013:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-7347",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=607179",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
            },
            {
              "name": "RHSA-2013:0128",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-7347",
    "datePublished": "2014-03-30T00:00:00",
    "dateReserved": "2014-03-29T00:00:00",
    "dateUpdated": "2024-08-06T18:01:20.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2007-4136 (GCVE-0-2007-4136)
Vulnerability from cvelistv5
Published
2007-11-14 00:00
Modified
2024-08-07 14:46
Severity ?
CWE
  • n/a
Summary
The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:46:38.687Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "27611",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27611"
          },
          {
            "name": "RHSA-2007:0640",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2007-0640.html"
          },
          {
            "name": "oval:org.mitre.oval:def:9871",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871"
          },
          {
            "name": "26393",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/26393"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=336101"
          },
          {
            "name": "1018921",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1018921"
          },
          {
            "name": "rhel-congaricci-dos(38358)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38358"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-10-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "27611",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27611"
        },
        {
          "name": "RHSA-2007:0640",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2007-0640.html"
        },
        {
          "name": "oval:org.mitre.oval:def:9871",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871"
        },
        {
          "name": "26393",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/26393"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=336101"
        },
        {
          "name": "1018921",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1018921"
        },
        {
          "name": "rhel-congaricci-dos(38358)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38358"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-4136",
    "datePublished": "2007-11-14T00:00:00",
    "dateReserved": "2007-08-02T00:00:00",
    "dateUpdated": "2024-08-07T14:46:38.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-6496 (GCVE-0-2013-6496)
Vulnerability from cvelistv5
Published
2014-10-06 14:00
Modified
2024-08-06 17:46
Severity ?
CWE
  • n/a
Summary
Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T17:46:22.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=971541"
          },
          {
            "name": "RHSA-2014:1194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-09-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-06T13:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=971541"
        },
        {
          "name": "RHSA-2014:1194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-6496",
    "datePublished": "2014-10-06T14:00:00",
    "dateReserved": "2013-11-04T00:00:00",
    "dateUpdated": "2024-08-06T17:46:22.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-3852 (GCVE-0-2010-3852)
Vulnerability from cvelistv5
Published
2010-11-05 22:00
Modified
2024-08-07 03:26
Severity ?
CWE
  • n/a
Summary
The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:26:12.252Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2010-2900",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/2900"
          },
          {
            "name": "44611",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/44611"
          },
          {
            "name": "42123",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42123"
          },
          {
            "name": "ADV-2010-2873",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/2873"
          },
          {
            "name": "FEDORA-2010-16617",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html"
          },
          {
            "name": "42113",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42113"
          },
          {
            "name": "FEDORA-2010-16848",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=626504"
          },
          {
            "name": "69015",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/69015"
          },
          {
            "name": "luci-whoini-weak-security(62980)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62980"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf"
          },
          {
            "name": "FEDORA-2010-16601",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-10-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses \"[INSERT SECRET HERE]\" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "ADV-2010-2900",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/2900"
        },
        {
          "name": "44611",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/44611"
        },
        {
          "name": "42123",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42123"
        },
        {
          "name": "ADV-2010-2873",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/2873"
        },
        {
          "name": "FEDORA-2010-16617",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html"
        },
        {
          "name": "42113",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42113"
        },
        {
          "name": "FEDORA-2010-16848",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=626504"
        },
        {
          "name": "69015",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/69015"
        },
        {
          "name": "luci-whoini-weak-security(62980)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62980"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf"
        },
        {
          "name": "FEDORA-2010-16601",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2010-3852",
    "datePublished": "2010-11-05T22:00:00",
    "dateReserved": "2010-10-08T00:00:00",
    "dateUpdated": "2024-08-07T03:26:12.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-0720 (GCVE-0-2011-0720)
Vulnerability from cvelistv5
Published
2011-02-03 16:00
Modified
2024-08-06 22:05
Severity ?
CWE
  • n/a
Summary
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
References
http://osvdb.org/70753 vdb-entry, x_refsource_OSVDB
http://plone.org/products/plone/security/advisories/cve-2011-0720 x_refsource_CONFIRM
http://www.securityfocus.com/bid/46102 vdb-entry, x_refsource_BID
http://secunia.com/advisories/43146 third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2011-0393.html vendor-advisory, x_refsource_REDHAT
https://exchange.xforce.ibmcloud.com/vulnerabilities/65099 vdb-entry, x_refsource_XF
http://www.vupen.com/english/advisories/2011/0796 vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/43914 third-party-advisory, x_refsource_SECUNIA
http://www.securitytracker.com/id?1025258 vdb-entry, x_refsource_SECTRACK
http://www.redhat.com/support/errata/RHSA-2011-0394.html vendor-advisory, x_refsource_REDHAT
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:05:53.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "70753",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/70753"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://plone.org/products/plone/security/advisories/cve-2011-0720"
          },
          {
            "name": "46102",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46102"
          },
          {
            "name": "43146",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43146"
          },
          {
            "name": "RHSA-2011:0393",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-0393.html"
          },
          {
            "name": "plone-unspec-priv-escalation(65099)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65099"
          },
          {
            "name": "ADV-2011-0796",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0796"
          },
          {
            "name": "43914",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43914"
          },
          {
            "name": "1025258",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1025258"
          },
          {
            "name": "RHSA-2011:0394",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-0394.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-02-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "70753",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/70753"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://plone.org/products/plone/security/advisories/cve-2011-0720"
        },
        {
          "name": "46102",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46102"
        },
        {
          "name": "43146",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43146"
        },
        {
          "name": "RHSA-2011:0393",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-0393.html"
        },
        {
          "name": "plone-unspec-priv-escalation(65099)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65099"
        },
        {
          "name": "ADV-2011-0796",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0796"
        },
        {
          "name": "43914",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43914"
        },
        {
          "name": "1025258",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1025258"
        },
        {
          "name": "RHSA-2011:0394",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-0394.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-0720",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "70753",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/70753"
            },
            {
              "name": "http://plone.org/products/plone/security/advisories/cve-2011-0720",
              "refsource": "CONFIRM",
              "url": "http://plone.org/products/plone/security/advisories/cve-2011-0720"
            },
            {
              "name": "46102",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46102"
            },
            {
              "name": "43146",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43146"
            },
            {
              "name": "RHSA-2011:0393",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-0393.html"
            },
            {
              "name": "plone-unspec-priv-escalation(65099)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65099"
            },
            {
              "name": "ADV-2011-0796",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0796"
            },
            {
              "name": "43914",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43914"
            },
            {
              "name": "1025258",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1025258"
            },
            {
              "name": "RHSA-2011:0394",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-0394.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-0720",
    "datePublished": "2011-02-03T16:00:00",
    "dateReserved": "2011-01-31T00:00:00",
    "dateUpdated": "2024-08-06T22:05:53.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-3521 (GCVE-0-2014-3521)
Vulnerability from cvelistv5
Published
2014-10-06 14:00
Modified
2024-08-06 10:50
Severity ?
CWE
  • n/a
Summary
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:50:16.842Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112813"
          },
          {
            "name": "RHSA-2014:1194",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-09-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-06T13:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112813"
        },
        {
          "name": "RHSA-2014:1194",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-3521",
    "datePublished": "2014-10-06T14:00:00",
    "dateReserved": "2014-05-14T00:00:00",
    "dateUpdated": "2024-08-06T10:50:16.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3359 (GCVE-0-2012-3359)
Vulnerability from cvelistv5
Published
2014-03-30 00:00
Modified
2024-08-06 20:05
Severity ?
CWE
  • n/a
Summary
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.449Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
          },
          {
            "name": "RHSA-2013:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-01-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Luci in Red Hat Conga stores the user\u0027s username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-03-30T00:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
        },
        {
          "name": "RHSA-2013:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3359",
    "datePublished": "2014-03-30T00:00:00",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-08-06T20:05:12.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2014-10-06 14:55
Modified
2025-04-12 10:46
Severity ?
Summary
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
References
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2014-1194.htmlVendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1112813
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2014-1194.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1112813
Impacted products
Vendor Product Version
redhat conga 0.12.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:0.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "33F8C3EC-F9F0-47E6-A754-12BB4D6870A5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL."
    },
    {
      "lang": "es",
      "value": "El componente en (1) /luci/homebase y (2) /luci/cluster menu en Red Hat Conga 0.12.2 permite a usuarios remotos autenticados evadir las restricciones de acceso a trav\u00e9s de una URL manipulada."
    }
  ],
  "id": "CVE-2014-3521",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-10-06T14:55:09.547",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112813"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112813"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2014-03-31 14:58
Modified
2025-04-12 10:46
Severity ?
Summary
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
References
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0128.htmlVendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=607179
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0128.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=607179
Impacted products
Vendor Product Version
redhat conga *
redhat enterprise_linux 5


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFDB782C-6A31-43A7-9A61-E94020AEE956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA9B3CC0-DF1C-4A86-B2A3-A9D428A5A6E6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Luci in Red Hat Conga stores the user\u0027s username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout."
    },
    {
      "lang": "es",
      "value": "Luci en Red Hat Conga almacena el nombre de usuario y la contrase\u00f1a del usuario en una cadena codificada en Base64 en la cookie de sesi\u00f3n __ac, lo que permite a atacantes ganar privilegios mediante el acceso a esta cookie.  NOTA: este problema ha sido dividido (SPLIT) debido a tipos de vulnerabilidad diferentes. Utilice CVE-2013-7347 para la ejecuci\u00f3n incorrecta de un timeout de usuario."
    }
  ],
  "id": "CVE-2012-3359",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 3.7,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 1.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-03-31T14:58:43.290",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2011-02-03 17:00
Modified
2025-04-11 00:51
Severity ?
Summary
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
References
cve@mitre.orghttp://osvdb.org/70753
cve@mitre.orghttp://plone.org/products/plone/security/advisories/cve-2011-0720Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/43146Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/43914Vendor Advisory
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2011-0393.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2011-0394.html
cve@mitre.orghttp://www.securityfocus.com/bid/46102
cve@mitre.orghttp://www.securitytracker.com/id?1025258
cve@mitre.orghttp://www.vupen.com/english/advisories/2011/0796Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/65099
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/70753
af854a3a-2127-422b-91ae-364da2661108http://plone.org/products/plone/security/advisories/cve-2011-0720Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43146Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43914Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2011-0393.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2011-0394.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/46102
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1025258
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0796Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/65099
Impacted products
Vendor Product Version
plone plone 2.5
plone plone 2.5.1
plone plone 2.5.2
plone plone 2.5.3
plone plone 2.5.4
plone plone 2.5.5
plone plone 3.0
plone plone 3.0.1
plone plone 3.0.2
plone plone 3.0.3
plone plone 3.0.4
plone plone 3.0.5
plone plone 3.0.6
plone plone 3.1
plone plone 3.1.1
plone plone 3.1.2
plone plone 3.1.3
plone plone 3.1.4
plone plone 3.1.5.1
plone plone 3.1.6
plone plone 3.1.7
plone plone 3.2
plone plone 3.2.1
plone plone 3.2.2
plone plone 3.2.3
plone plone 3.3
plone plone 3.3.1
plone plone 3.3.2
plone plone 3.3.3
plone plone 3.3.4
plone plone 3.3.5
plone plone 4.0
redhat conga *
redhat luci *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9762C674-380B-4831-BBA1-3B27742121B0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D938645-80CE-4287-830E-A3BD0C5C84FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB0F7BFC-DC20-46B3-90E7-264E3A8A7886",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2C09C10-AEA0-41F4-B964-507B40580BE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B60568E-A688-46AF-B627-062A029A7324",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B635DAD-AC53-4484-8750-200B662DAFD1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B647E76-E8B8-4329-8848-3B90EB262807",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D0A6B8F-4018-44DC-9862-45309619DC6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F10374F-2BB3-48D2-B19F-9B2D038A8E35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEAC4F93-D26C-48F3-A7FF-8DC008FC2671",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "552661B7-093D-4B3C-8770-FCDE6032AA17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "5180F9D2-E44B-455D-968C-792026AC832A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "636226E4-B880-41FE-A727-EF56CF8E6249",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF6E934A-C344-4861-8CD4-D18D52672D5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "25780BBE-8013-4100-9EA8-7EFC244399A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A089ED64-07E6-4F4C-97AE-AF74269A4DB1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF2334C9-9B34-4C7D-93A2-172E596E05C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "354046F4-FA55-4AFC-935A-C803D36CDE86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF1496A7-6D0A-4970-B0BF-83758065BC6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "47DEF57C-92F0-4999-AF8E-CEE27EE92CD6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BED4241-D823-402A-A389-7E52C410E2F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE9A55E6-F265-4BB8-8683-3E0CFA01EC73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "970FD910-50A4-478A-ADE6-EB912C261DAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A490523-1063-44E4-A72A-C23070279181",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8559F17-63D1-45DB-8A28-47F729DC6686",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDC93803-6506-4382-A013-18010EE7E06B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E65977FD-A880-4D16-B56B-94A72774F42D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EA5B4F8-2155-403D-97D8-1272285D508B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3CA2943-77E5-4384-A019-415BBCE62F94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7FF63F6-F1DC-4A97-A2E6-11CF613A31E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "538A3519-5B04-4FE5-A3C0-FD26EFA32705",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3306D84-0F5B-46BA-9BCC-DCD0A1CDD604",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFDB782C-6A31-43A7-9A61-E94020AEE956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:luci:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "00AB76EC-83A6-405B-858F-CE4FF59AEAEA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad no especificada en Plone versi\u00f3n 2.5 hasta 4.0, como se utiliza en Conga, luci, y posiblemente otros productos, permite a los atacantes remotos obtener acceso administrativo, leer o crear contenido arbitrario, y cambiar el aspecto del sitio por medio de vectores desconocidos."
    }
  ],
  "id": "CVE-2011-0720",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-02-03T17:00:03.773",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/70753"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://plone.org/products/plone/security/advisories/cve-2011-0720"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43146"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43914"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0393.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0394.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/46102"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1025258"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0796"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65099"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/70753"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://plone.org/products/plone/security/advisories/cve-2011-0720"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43146"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/43914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0393.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0394.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/46102"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1025258"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2011/0796"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65099"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2014-10-06 14:55
Modified
2025-04-12 10:46
Severity ?
Summary
Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.
References
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2014-1194.htmlVendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=971541
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2014-1194.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=971541
Impacted products
Vendor Product Version
redhat conga 0.12.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:0.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "33F8C3EC-F9F0-47E6-A754-12BB4D6870A5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension."
    },
    {
      "lang": "es",
      "value": "Red Hat Conga 0.12.2 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud manipulada en la extensi\u00f3n (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, o (5) logs Luci."
    }
  ],
  "id": "CVE-2013-6496",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-10-06T14:55:07.860",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=971541"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1194.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=971541"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2014-03-31 14:58
Modified
2025-04-12 10:46
Severity ?
Summary
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
References
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2013-0128.htmlVendor Advisory
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=607179
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-0128.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=607179
Impacted products
Vendor Product Version
redhat conga *
redhat enterprise_linux 5


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFDB782C-6A31-43A7-9A61-E94020AEE956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA9B3CC0-DF1C-4A86-B2A3-A9D428A5A6E6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie."
    },
    {
      "lang": "es",
      "value": "Luci en Red Hat Conga no fuerza debidamente el timeout de la sesi\u00f3n de usuario, lo que podr\u00eda permitir a atacantes ganar acceso a la sesi\u00f3n mediante la lectura de la cookie de sesi\u00f3n __ac.  NOTA: este problema ha sido dividido (SPLIT) debido a tipos de vulnerabilidad diferentes. Utilice CVE-2012-3359 para el almacenaje de base64 codificado del usuario y contrase\u00f1a en una cookie."
    }
  ],
  "id": "CVE-2013-7347",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 3.7,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 1.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-03-31T14:58:45.070",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0128.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=607179"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2010-11-06 00:00
Modified
2025-04-11 00:51
Severity ?
Summary
The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.
References
secalert@redhat.comhttp://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html
secalert@redhat.comhttp://osvdb.org/69015
secalert@redhat.comhttp://secunia.com/advisories/42113Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/42123Vendor Advisory
secalert@redhat.comhttp://www.securityfocus.com/bid/44611
secalert@redhat.comhttp://www.vupen.com/english/advisories/2010/2873Vendor Advisory
secalert@redhat.comhttp://www.vupen.com/english/advisories/2010/2900
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=626504
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/62980
af854a3a-2127-422b-91ae-364da2661108http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/69015
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42113Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42123Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/44611
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/2873Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/2900
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=626504
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/62980
Impacted products
Vendor Product Version
redhat luci *
redhat conga *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:luci:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9CDDFBC-3FDF-4233-9A43-137F129FC922",
              "versionEndIncluding": "0.22.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFDB782C-6A31-43A7-9A61-E94020AEE956",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses \"[INSERT SECRET HERE]\" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie."
    },
    {
      "lang": "es",
      "value": "La configuraci\u00f3n por defecto de Luci v0.22.4 y anteriores en Red Hat Conga utiliza \"[INSERT SECRET HERE]\" como su clave secreta para las cookies, lo que facilita a los atacantes remotos el saltarse la autenticaci\u00f3n a trav\u00e9s de una cookie repoze.who falsificada."
    }
  ],
  "id": "CVE-2010-3852",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-11-06T00:00:02.423",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/69015"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/42113"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/42123"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/44611"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/2873"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2010/2900"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=626504"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62980"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/69015"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/42113"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/42123"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/44611"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/2873"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/2900"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=626504"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62980"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2007-11-14 00:46
Modified
2025-04-09 00:30
Severity ?
Summary
The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.
References
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2007-0640.htmlPatch
secalert@redhat.comhttp://secunia.com/advisories/27611Vendor Advisory
secalert@redhat.comhttp://securitytracker.com/id?1018921Patch
secalert@redhat.comhttp://www.securityfocus.com/bid/26393
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=336101
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/38358
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2007-0640.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27611Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1018921Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/26393
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=336101
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/38358
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871
Impacted products
Vendor Product Version
redhat conga 0.10.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:conga:0.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F86EEB6B-0815-4D98-B082-6ADCECA6DCD6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections."
    },
    {
      "lang": "es",
      "value": "El demonio ricci en Red Hat Conga versi\u00f3n 0.10.0,  permite a atacantes remotos causar una denegaci\u00f3n de servicio (p\u00e9rdida de conexiones nuevas) mediante un env\u00edo de datos o intento de conexiones de manera repetitiva."
    }
  ],
  "id": "CVE-2007-4136",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-11-14T00:46:00.000",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0640.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27611"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://securitytracker.com/id?1018921"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/26393"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=336101"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38358"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://rhn.redhat.com/errata/RHSA-2007-0640.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27611"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://securitytracker.com/id?1018921"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/26393"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=336101"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38358"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9871"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}