python-sqlparse vulnerabilities (Red Hat)
253 vulnerabilities.
-
python-sqlparseRed Hat Rubygem-katello: improper authorization logic allows resource enumeration 4.3 Medium -
python-sqlparseRed Hat Rubygem-katello: sql injection in registry proxy via labels 6.5 Medium -
python-sqlparseRed Hat Rubygem-hammer_cli: command injection via insecure editor invocation 6.7 Medium -
python-sqlparseRed Hat Foreman: command injection in foreman-tail 5.3 Medium -
python-sqlparseRed Hat Foreman: excessive permissions for viewer role on preview 9.1 Critical -
python-sqlparseRed Hat Foreman: foreman: arbitrary code execution via safemode sandbox bypass 8.8 High -
python-sqlparseRed Hat Foreman: ssti and insecure deserialization in foreman-rake configuration 7.7 High -
python-sqlparseRed Hat Foreman: command injection in foreman-rake database tasks 8.2 High -
python-sqlparseRed Hat Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter 8.2 High -
python-sqlparseRed Hat Foreman: unauthenticated information disclosure via provisioning token validation flaw 7.5 High -
python-sqlparseRed Hat Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter 8.8 High -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
python-sqlparseRed Hat Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process 6.6 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle 6.5 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust 4.3 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates 5.3 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames 6.6 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership 5.3 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane) 9.9 Critical -
python-sqlparseRed Hat Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-cor… 7.1 High -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in… 7.6 High -
python-sqlparseRed Hat Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups 9.1 Critical -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admin… 8.7 High -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling… 8.7 High -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error me… 7.7 High -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod 9.9 Critical -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisionin… 9.9 Critical -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation o… 8.2 High -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable 3.1 Low -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard 3.1 Low -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks 2.7 Low -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod 4.1 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/ 4.3 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure 5.0 Medium -
python-sqlparseRed Hat Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration 5.0 Medium -
python-sqlparseRed Hat GitPython before 3.1.60 Denial of Service via ReDoS 8.7 High -
python-sqlparseRed Hat GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation 8.7 High - Show olderLoading…