Red Hat
Page 10 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3782 | Critical | 9.1 | 2023-01-13 | keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker ca… |
CVE-2022-3143 | High | 7.4 | 2023-01-13 | wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in sev… |
CVE-2022-4743 | High | 7.5 | 2023-01-12 | A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a den… |
CVE-2022-43844 | High | 8.8 | 2023-01-05 | IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform… |
CVE-2022-43573 | Low | 3.1 | 2023-01-05 | IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-… |
CVE-2022-41740 | Medium | 4.6 | 2023-01-05 | IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from sys… |
CVE-2022-3715 | High | 7.8 | 2023-01-05 | A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems. |
CVE-2022-42264 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range… |
CVE-2022-42263 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an Integer overflow may lead to denial of service or infor… |
CVE-2022-42262 | High | 7.1 | 2022-12-30 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun… |
CVE-2022-42261 | High | 7.8 | 2022-12-30 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun… |
CVE-2022-42260 | High | 7.8 | 2022-12-30 | NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protec… |
CVE-2022-42259 | Medium | 4.4 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service. |
CVE-2022-42258 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, dat… |
CVE-2022-42257 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure… |
CVE-2022-42256 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow in index validation may lead to de… |
CVE-2022-42255 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-42254 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-34684 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or info… |
CVE-2022-34682 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a null-pointer dereference… |
CVE-2022-34680 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, w… |
CVE-2022-34679 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unhandled return value can lead to a null-pointer deref… |
CVE-2022-34678 | Medium | 6.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause a null-pointer derefere… |
CVE-2022-34677 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be tr… |
CVE-2022-34676 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, infor… |
CVE-2022-34675 | Medium | 5.5 | 2022-12-30 | NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference… |
CVE-2022-34674 | Medium | 6.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were reque… |
CVE-2022-34670 | High | 7.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors w… |
CVE-2021-4294 | Low | 2.6 | 2022-12-28 | A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipu… |
CVE-2022-38065 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality wit… |
CVE-2022-3775 | High | 7.1 | 2022-12-19 | When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size… |
CVE-2022-4130 | Medium | 4.5 | 2022-12-16 | A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by… |
CVE-2022-4283 | High | 7.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bo… |
CVE-2022-46344 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in… |
CVE-2022-46343 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has bee… |
CVE-2022-46342 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been f… |
CVE-2022-46341 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked wi… |
CVE-2022-46340 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the st… |
CVE-2022-2601 | High | 8.6 | 2022-12-14 | A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, all… |
CVE-2022-3259 | High | 7.4 | 2022-12-09 | Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. |
CVE-2022-3262 | High | 8.1 | 2022-12-08 | A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an a… |
CVE-2022-3260 | Medium | 4.8 | 2022-12-08 | The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly… |
CVE-2022-4144 | Medium | 6.5 | 2022-11-29 | An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed… |
CVE-2022-4116 | Critical | 9.8 | 2022-11-22 | A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote co… |
CVE-2022-3500 | Medium | 5.1 | 2022-11-22 | A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibilit… |
CVE-2022-34666 | Medium | 6.5 | 2022-11-10 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-… |
CVE-2022-3821 | Medium | 5.5 | 2022-11-08 | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accurac… |
CVE-2022-42442 | Low | 3.3 | 2022-11-03 | IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to… |
CVE-2022-3675 | Low | 2.6 | 2022-11-03 | Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB comm… |
CVE-2022-3697 | High | 7.5 | 2022-10-28 | A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an a… |
CVE-2022-3644 | Medium | 5.5 | 2022-10-25 | The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () in… |
CVE-2022-2805 | Medium | 6.5 | 2022-10-19 | A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with s… |
CVE-2022-1414 | High | 8.8 | 2022-10-19 | 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and… |
CVE-2013-4281 | Medium | 5.5 | 2022-10-19 | In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with loca… |
CVE-2013-4253 | High | 7.5 | 2022-10-19 | The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's aut… |
CVE-2019-14841 | High | 8.8 | 2022-10-17 | A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin… |
CVE-2019-14840 | High | 7.5 | 2022-10-17 | A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials. |
CVE-2017-7517 | Low | 3.5 | 2022-10-17 | An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a… |
CVE-2022-2963 | High | 7.5 | 2022-10-14 | A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentat… |
CVE-2022-2850 | Medium | 6.5 | 2022-10-14 | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a special… |
CVE-2020-15855 | Medium | 6.1 | 2022-10-07 | Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1. |
CVE-2015-1931 | Medium | 5.5 | 2022-09-29 | IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16… |
CVE-2014-0148 | Medium | 5.5 | 2022-09-29 | Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bo… |
CVE-2014-0147 | Medium | 6.2 | 2022-09-29 | Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by… |
CVE-2014-0144 | High | 8.6 | 2022-09-29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overf… |
CVE-2022-3205 | Medium | 4.6 | 2022-09-13 | Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection |
CVE-2022-2990 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modificat… |
CVE-2022-2989 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modificati… |
CVE-2022-1278 | High | 7.5 | 2022-09-13 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. |
CVE-2022-2964 | High | 7.8 | 2022-09-09 | A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-… |
CVE-2022-2905 | Medium | 5.5 | 2022-09-09 | An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_e… |
CVE-2020-10735 | High | 7.5 | 2022-09-09 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an i… |
CVE-2022-25310 | Medium | 5.5 | 2022-09-06 | A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw all… |
CVE-2022-25309 | Medium | 5.5 | 2022-09-06 | A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c fil… |
CVE-2022-25308 | High | 7.8 | 2022-09-06 | A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application… |
CVE-2022-23451 | High | 8.1 | 2022-09-06 | An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or d… |
CVE-2022-2764 | Medium | 4.9 | 2022-09-01 | A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations. |
CVE-2022-2739 | Medium | 5.3 | 2022-09-01 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for… |
CVE-2022-2738 | High | 7.5 | 2022-09-01 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for… |
CVE-2022-2639 | High | 7.8 | 2022-09-01 | An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a ne… |
CVE-2022-2447 | Medium | 6.6 | 2022-09-01 | A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from… |
CVE-2022-2403 | Medium | 6.5 | 2022-09-01 | A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serv… |
CVE-2022-2256 | Low | 3.8 | 2022-09-01 | A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execu… |
CVE-2022-2238 | Medium | 6.5 | 2022-09-01 | A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by th… |
CVE-2022-23452 | Medium | 4.9 | 2022-09-01 | An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an… |
CVE-2022-1902 | High | 8.8 | 2022-09-01 | A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows aut… |
CVE-2022-1677 | Medium | 6.3 | 2022-09-01 | In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster… |
CVE-2022-1632 | Medium | 6.5 | 2022-09-01 | An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skip… |
CVE-2022-2153 | Medium | 5.5 | 2022-08-31 | A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs… |
CVE-2022-2132 | High | 8.6 | 2022-08-31 | A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vho… |
CVE-2022-1355 | Medium | 6.1 | 2022-08-31 | A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, t… |
CVE-2022-1354 | Medium | 5.5 | 2022-08-31 | A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to… |
CVE-2022-1319 | High | 7.5 | 2022-08-31 | A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though… |
CVE-2022-1271 | High | 8.8 | 2022-08-31 | An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted f… |
CVE-2022-1263 | Medium | 5.5 | 2022-08-31 | A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the… |
CVE-2022-1259 | High | 7.5 | 2022-08-31 | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the s… |
CVE-2022-1247 | High | 7.0 | 2022-08-31 | An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using t… |
CVE-2022-1199 | High | 7.5 | 2022-08-29 | A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a nu… |
CVE-2022-1198 | Medium | 5.5 | 2022-08-29 | A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 devic… |
CVE-2022-1184 | Medium | 5.5 | 2022-08-29 | A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a u… |