NVD List
| Id | Name | Description | Reject | CVSS Version | CVSS Score | Severity | Pub Date | Modified Date | Actions |
|---|---|---|---|---|---|---|---|---|---|
| 67357 | CVE-2005-1632 | Cheetah 0.9.15 and 0.9.16 searches the /tmp directory for modules before using the paths in the PYTHONPATH variable, which allows local users to execute arbitrary code via a malicious module in /tmp/. | 2 | 7.2 | High | 2017-01-03 | 2008-09-05 | View | |
| 87565 | CVE-2017-1000026 | Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using .. in tar archive entries | 2017-07-18 | 2017-07-17 | View | ||||
| 11358 | CVE-2011-5098 | chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option. | 2 | 6.5 | Medium | 2017-01-07 | 2012-08-10 | View | |
| 11357 | CVE-2011-5097 | chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command. | 2 | 5.5 | Medium | 2017-01-07 | 2012-08-13 | View | |
| 16351 | CVE-2010-5142 | chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI. | 2 | 6.5 | Medium | 2017-01-18 | 2012-08-13 | View |
Page 2371 of 17672, showing 5 records out of 88360 total, starting on record 11851, ending on 11855
