Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data

A flaw was found in the Ansible Automation Platform

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

A flaw was found in the python-cryptography package

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the…

A flaw was found in Ansible, where a user's controller is vulnerable to template injection

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

A path traversal vulnerability exists in Ansible when extracting tarballs

An Improper Certificate Validation attack was found in Openshift

A privilege escalation flaw was found in the Ansible Automation Platform

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

An absolute path traversal attack exists in the Ansible automation platform

A logic flaw exists in Ansible Automation platform

A vulnerability was found in aap-gateway

Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it…

A flaw was found in Ansible Galaxy Collections

An HTML injection flaw was found in Controller in the user interface settings

A flaw was found in Ansible

A flaw was found in Ansible