Red Hat
Page 20 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8672 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3… |
CVE-2019-8669 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3… |
CVE-2019-8544 | High | 8.8 | 2019-12-18 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for… |
CVE-2019-8536 | High | 8.8 | 2019-12-18 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for… |
CVE-2019-8535 | High | 8.8 | 2019-12-18 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCl… |
CVE-2019-8506 | High | 8.8 | 2019-12-18 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Win… |
CVE-2012-2312 | High | 7.8 | 2019-12-18 | An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reuse… |
CVE-2019-19880 | High | 7.5 | 2019-12-18 | exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses… |
CVE-2014-3701 | High | 8.1 | 2019-12-15 | eDeploy has tmp file race condition flaws |
CVE-2014-3699 | Critical | 9.8 | 2019-12-15 | eDeploy has RCE via cPickle deserialization of untrusted data |
CVE-2014-3652 | Medium | 6.1 | 2019-12-15 | JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL. |
CVE-2014-3536 | Medium | 5.5 | 2019-12-15 | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration |
CVE-2014-0241 | Medium | 5.5 | 2019-12-13 | rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable |
CVE-2014-0197 | High | 8.8 | 2019-12-13 | CFME: CSRF protection vulnerability via permissive check of the referrer header |
CVE-2014-0175 | Critical | 9.8 | 2019-12-13 | mcollective has a default password set at install |
CVE-2019-16777 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritt… |
CVE-2019-16776 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules f… |
CVE-2019-16775 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_m… |
CVE-2019-14849 | Medium | 5.4 | 2019-12-12 | A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cr… |
CVE-2014-0163 | High | 8.8 | 2019-12-11 | Openshift has shell command injection flaws due to unsanitized data being passed into shell commands. |
CVE-2014-0026 | Medium | 6.5 | 2019-12-11 | katello-headpin is vulnerable to CSRF in REST API |
CVE-2013-7370 | Medium | 6.1 | 2019-12-11 | node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware |
CVE-2013-6495 | Medium | 6.1 | 2019-12-11 | JBossWeb Bayeux has reflected XSS |
CVE-2019-13764 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13763 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2019-13762 | Low | 3.3 | 2019-12-10 | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local cod… |
CVE-2019-13761 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d… |
CVE-2019-13759 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13758 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2019-13757 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d… |
CVE-2019-13756 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13755 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page. |
CVE-2019-13754 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2019-13753 | Medium | 6.5 | 2019-12-10 | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13752 | Medium | 6.5 | 2019-12-10 | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13751 | Medium | 6.5 | 2019-12-10 | Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13750 | Medium | 6.5 | 2019-12-10 | Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML… |
CVE-2019-13749 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13748 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information… |
CVE-2019-13747 | High | 8.8 | 2019-12-10 | Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-13746 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2019-13745 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13744 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13743 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML pa… |
CVE-2019-13742 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13741 | High | 8.8 | 2019-12-10 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted cl… |
CVE-2019-13740 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13739 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a… |
CVE-2019-13738 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2019-13737 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2019-13736 | High | 8.8 | 2019-12-10 | Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-13735 | High | 8.8 | 2019-12-10 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTM… |
CVE-2019-13734 | High | 8.8 | 2019-12-10 | Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13732 | High | 8.8 | 2019-12-10 | Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13730 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13729 | High | 8.8 | 2019-12-10 | Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13728 | High | 8.8 | 2019-12-10 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-13727 | High | 8.8 | 2019-12-10 | Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2019-13726 | High | 8.8 | 2019-12-10 | Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2019-13725 | High | 8.8 | 2019-12-10 | Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2013-2167 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass |
CVE-2013-2166 | Critical | 9.8 | 2019-12-10 | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass |
CVE-2014-3656 | Medium | 6.1 | 2019-12-10 | JBoss KeyCloak: XSS in login-status-iframe.html |
CVE-2013-1793 | High | 7.5 | 2019-12-10 | openstack-utils openstack-db has insecure password creation |
CVE-2012-2148 | Low | 3.3 | 2019-12-06 | An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies |
CVE-2019-5544 | Critical | 9.8 | 2019-12-06 | OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical sever… |
CVE-2019-19334 | Critical | 9.8 | 2019-12-06 | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref"… |
CVE-2019-19333 | Critical | 9.8 | 2019-12-06 | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An appl… |
CVE-2019-19624 | Medium | 6.5 | 2019-12-06 | An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale withi… |
CVE-2019-11255 | Medium | 4.8 | 2019-12-05 | Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4… |
CVE-2019-14910 | Critical | 9.8 | 2019-12-05 | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (… |
CVE-2013-0163 | Medium | 5.5 | 2019-12-05 | OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS |
CVE-2019-14909 | High | 8.3 | 2019-12-04 | A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accept… |
CVE-2019-13456 | Medium | 6.5 | 2019-12-03 | In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the… |
CVE-2013-4486 | Critical | 9.8 | 2019-12-03 | Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging |
CVE-2013-4235 | Medium | 4.7 | 2019-12-03 | shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees |
CVE-2013-2103 | High | 8.1 | 2019-12-03 | OpenShift cartridge allows remote URL retrieval |
CVE-2013-2101 | Medium | 5.4 | 2019-12-03 | Katello has multiple XSS issues in various entities |
CVE-2012-5562 | High | 8.6 | 2019-12-02 | A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could… |
CVE-2019-14865 | Medium | 5.9 | 2019-11-29 | A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), c… |
CVE-2019-19319 | Medium | 6.5 | 2019-11-27 | In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xat… |
CVE-2019-18660 | Medium | 4.7 | 2019-11-27 | The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72b… |
CVE-2011-2717 | Critical | 9.8 | 2019-11-27 | The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters i… |
CVE-2011-2515 | Medium | 5.3 | 2019-11-27 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of… |
CVE-2011-2207 | Medium | 5.3 | 2019-11-27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certific… |
CVE-2012-6655 | Low | 3.3 | 2019-11-27 | An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords. |
CVE-2019-19242 | Medium | 5.9 | 2019-11-27 | SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. |
CVE-2016-4980 | Low | 2.5 | 2019-11-27 | A password generation weakness exists in xquest through 2016-06-13. |
CVE-2019-10216 | High | 7.8 | 2019-11-27 | In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions… |
CVE-2019-14896 | Critical | 9.8 | 2019-11-27 | A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a d… |
CVE-2019-14842 | Critical | 9.8 | 2019-11-26 | Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk o… |
CVE-2019-14856 | Medium | 6.5 | 2019-11-26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None |
CVE-2019-14890 | High | 8.4 | 2019-11-26 | A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RH… |
CVE-2011-3632 | High | 7.1 | 2019-11-26 | Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks. |
CVE-2011-3631 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calc… |
CVE-2011-3630 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A… |
CVE-2011-3609 | Medium | 6.5 | 2019-11-26 | A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example vi… |
CVE-2011-3606 | Medium | 5.4 | 2019-11-26 | A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a… |
CVE-2019-10217 | Medium | 6.5 | 2019-11-25 | A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are… |
CVE-2019-13723 | High | 8.8 | 2019-11-25 | Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploi… |