CVE-2021-3620

< 2.9.27

A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials i

5.5MEDIUM

CVE-2021-3583

< 2.9.23

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts use

7.1HIGH

CVE-2020-10729

< 2.9.6

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate th

5.5MEDIUM

CVE-2021-20228

all versions

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log fe

7.5HIGH

CVE-2020-14365

>= 2.8.0 and <= 2.8.15

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when install

7.1HIGH

CVE-2020-14332

>= 2.8.0 and < 2.8.14

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutr

5.5MEDIUM

CVE-2020-14330

< 2.9.12

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to

5.0MEDIUM

CVE-2020-1746

>= 2.7.0 and < 2.7.17

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x bef

5.0MEDIUM

CVE-2020-10685

>= 2.7.0 and < 2.7.17

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before

5.0MEDIUM

CVE-2020-10691

>= 2.9.0 and < 2.9.7

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection in

5.2MEDIUM

CVE-2019-14905

>= 2.7.0 and < 2.7.16

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, wher

5.6MEDIUM

CVE-2020-1753

< 2.7.18

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.1

5.0MEDIUM

CVE-2020-1737

< 2.7.17

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the wi

7.5HIGH

CVE-2020-1734

<= 2.7.16

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.

7.4HIGH

CVE-2019-14858

>= 2.0 and <= 2.8.0

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with

5.5MEDIUM

CVE-2019-14846

< 2.6.20

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at

7.8HIGH

CVE-2018-16876

all versions

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can

5.3MEDIUM

CVE-2018-16859

< 2.5.13

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for '

4.2MEDIUM

CVE-2018-16837

all versions

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations su

7.8HIGH

CVE-2016-8647

< 2.2.1.0

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a pa

4.9MEDIUM

CVE-2017-7481

< 2.3.1.0

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control t

9.8CRITICAL

CVE-2018-10875

all versions

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plu

7.8HIGH

CVE-2018-10855

>= 2.4 and < 2.4.5

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has b

5.9MEDIUM

CVE-2018-10874

all versions

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are u

7.8HIGH

CVE-2018-7750

all versions

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.

9.8CRITICAL