Pacemaker/corosync Configuration System Project Pacemaker/corosync Configuration System vulnerabilities

2 CVEs affecting Pacemaker/corosync Configuration System Project Pacemaker/corosync Configuration System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-5190, published 2015-09-03.

More from Pacemaker/corosync Configuration System Project.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-5190, published 2015-09-03. High severity, CVSS 8.5. EPSS: 2.5% chance of exploitation in the next 30 days. The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
• CVE-2015-5189, published 2015-09-03. Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days. Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for…