Red Hat
Page 21 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10213 | Medium | 6.5 | 2019-11-25 | OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or… |
CVE-2012-5644 | Medium | 5.5 | 2019-11-25 | libuser has information disclosure when moving user's home directory |
CVE-2012-5630 | Medium | 6.3 | 2019-11-25 | libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. |
CVE-2012-5521 | Medium | 6.5 | 2019-11-25 | quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal |
CVE-2019-14822 | High | 7.1 | 2019-11-25 | A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due… |
CVE-2019-14891 | Medium | 5.0 | 2019-11-25 | A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) pr… |
CVE-2019-14815 | High | 7.8 | 2019-11-25 | A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver. |
CVE-2019-10214 | Medium | 5.9 | 2019-11-25 | The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Pla… |
CVE-2019-10174 | High | 8.8 | 2019-11-25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke priva… |
CVE-2019-11287 | High | 7.5 | 2019-11-23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versio… |
CVE-2019-11291 | Medium | 4.8 | 2019-11-22 | Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prio… |
CVE-2012-0877 | High | 7.5 | 2019-11-22 | PyXML: Hash table collisions CPU usage Denial of Service |
CVE-2015-7810 | Medium | 4.7 | 2019-11-22 | libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files |
CVE-2015-5694 | Medium | 6.5 | 2019-11-22 | Designate does not enforce the DNS protocol limit concerning record set sizes |
CVE-2015-1780 | Medium | 6.5 | 2019-11-22 | oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center |
CVE-2014-3585 | Critical | 9.8 | 2019-11-22 | redhat-upgrade-tool: Does not check GPG signatures when upgrading versions |
CVE-2019-10206 | Medium | 6.5 | 2019-11-22 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding… |
CVE-2018-10854 | Medium | 5.4 | 2019-11-22 | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping del… |
CVE-2014-3700 | Critical | 9.8 | 2019-11-21 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data |
CVE-2014-0084 | Medium | 5.5 | 2019-11-21 | Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly. |
CVE-2012-3460 | Critical | 9.8 | 2019-11-21 | cumin: At installation postgresql database user created without password |
CVE-2013-1817 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. |
CVE-2013-1816 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted reques… |
CVE-2012-6136 | Medium | 5.5 | 2019-11-20 | tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. |
CVE-2012-6135 | High | 7.5 | 2019-11-19 | RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. |
CVE-2011-4967 | High | 7.5 | 2019-11-19 | tog-Pegasus has a package hash collision DoS vulnerability |
CVE-2014-5118 | Medium | 5.5 | 2019-11-18 | Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2019-19081 | Medium | 5.9 | 2019-11-18 | A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attacke… |
CVE-2019-19076 | Medium | 5.9 | 2019-11-18 | A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to… |
CVE-2019-19072 | Medium | 4.4 | 2019-11-18 | A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of… |
CVE-2019-19068 | Medium | 4.6 | 2019-11-18 | A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows atta… |
CVE-2019-19066 | Medium | 4.7 | 2019-11-18 | A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of serv… |
CVE-2019-19062 | Medium | 4.7 | 2019-11-18 | A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (me… |
CVE-2019-19012 | Critical | 9.8 | 2019-11-17 | An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this… |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2016-5285 | High | 7.5 | 2019-11-15 | A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMAC… |
CVE-2014-0023 | High | 7.8 | 2019-11-15 | OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution |
CVE-2018-12207 | Medium | 6.5 | 2019-11-14 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentiall… |
CVE-2019-11135 | Medium | 6.5 | 2019-11-14 | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via… |
CVE-2019-0155 | High | 7.8 | 2019-11-14 | Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R)… |
CVE-2019-14818 | High | 7.5 | 2019-11-14 | A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, o… |
CVE-2012-1168 | High | 8.2 | 2019-11-14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified. |
CVE-2012-1156 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has users' private files included in course backups |
CVE-2012-1155 | High | 7.5 | 2019-11-14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the… |
CVE-2011-1145 | High | 7.8 | 2019-11-14 | The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in t… |
CVE-2010-4664 | High | 8.8 | 2019-11-13 | In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privilege… |
CVE-2010-4661 | High | 7.8 | 2019-11-13 | udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules. |
CVE-2010-4657 | High | 7.5 | 2019-11-13 | PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak in… |
CVE-2014-8167 | Medium | 5.9 | 2019-11-13 | vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack |
CVE-2014-3655 | Medium | 4.3 | 2019-11-13 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
CVE-2014-3592 | Medium | 6.1 | 2019-11-13 | OpenShift Origin: Improperly validated team names could allow stored XSS attacks |
CVE-2010-3857 | Medium | 6.1 | 2019-11-12 | JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter. |
CVE-2014-3599 | Medium | 6.5 | 2019-11-12 | HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy |
CVE-2011-2897 | Critical | 9.8 | 2019-11-12 | gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw |
CVE-2009-3552 | Low | 3.1 | 2019-11-09 | In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a W… |
CVE-2019-3866 | Medium | 5.5 | 2019-11-08 | An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable… |
CVE-2019-14860 | Medium | 6.5 | 2019-11-08 | It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to c… |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2019-10222 | High | 7.5 | 2019-11-08 | A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW serve… |
CVE-2019-10219 | Medium | 6.1 | 2019-11-08 | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious cod… |
CVE-2013-1820 | Medium | 5.5 | 2019-11-08 | tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. |
CVE-2008-5083 | Medium | 6.5 | 2019-11-08 | In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. |
CVE-2008-3278 | High | 7.8 | 2019-11-07 | frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/… |
CVE-2019-18811 | Medium | 5.5 | 2019-11-07 | A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of serv… |
CVE-2019-18805 | Critical | 9.8 | 2019-11-07 | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_upd… |
CVE-2016-1000037 | Medium | 6.1 | 2019-11-06 | Pagure: XSS possible in file attachment endpoint |
CVE-2014-8181 | Medium | 5.5 | 2019-11-06 | The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace. |
CVE-2016-4983 | Low | 3.3 | 2019-11-05 | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. |
CVE-2013-5123 | Medium | 5.9 | 2019-11-05 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-… |
CVE-2010-2222 | High | 7.5 | 2019-11-05 | The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer derefere… |
CVE-2013-5661 | Medium | 5.9 | 2019-11-05 | Cache Poisoning issue exists in DNS Response Rate Limiting. |
CVE-2013-6461 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
CVE-2013-6460 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
CVE-2016-1000002 | Low | 2.4 | 2019-11-05 | gdm3 3.14.2 and possibly later has an information leak before screen lock |
CVE-2019-10223 | Medium | 6.5 | 2019-11-05 | A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled anno… |
CVE-2013-4374 | High | 7.1 | 2019-11-04 | An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files. |
CVE-2017-5333 | High | 7.8 | 2019-11-04 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of s… |
CVE-2017-5332 | High | 7.8 | 2019-11-04 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denia… |
CVE-2015-8980 | Critical | 9.8 | 2019-11-04 | The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. |
CVE-2013-4409 | Critical | 9.8 | 2019-11-04 | An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. |
CVE-2013-4251 | High | 7.8 | 2019-11-04 | The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. |
CVE-2013-4280 | Medium | 5.5 | 2019-11-04 | Insecure temporary file vulnerability in RedHat vsdm 4.9.6. |
CVE-2005-4890 | High | 7.8 | 2019-11-04 | There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the paren… |
CVE-2014-3649 | Medium | 6.1 | 2019-11-04 | JBoss AeroGear has reflected XSS via the password field |
CVE-2013-4518 | Medium | 5.5 | 2019-11-04 | RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates |
CVE-2013-4423 | Medium | 5.5 | 2019-11-04 | CloudForms stores user passwords in recoverable format |
CVE-2019-6470 | Medium | 6.5 | 2019-11-01 | There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd rela… |
CVE-2013-2255 | Medium | 5.9 | 2019-11-01 | HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. |
CVE-2013-0186 | Medium | 6.1 | 2019-11-01 | Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2013-0165 | High | 7.3 | 2019-11-01 | cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. |
CVE-2011-3923 | Critical | 9.8 | 2019-11-01 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. |
CVE-2013-4751 | High | 8.1 | 2019-11-01 | php-symfony2-Validator has loss of information during serialization |
CVE-2013-3718 | Medium | 5.5 | 2019-11-01 | evince is missing a check on number of pages which can lead to a segmentation fault |
CVE-2019-5010 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate… |
CVE-2010-2783 | Critical | 9.1 | 2019-10-31 | IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services. |
CVE-2010-2548 | Critical | 9.1 | 2019-10-31 | IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files. |
CVE-2010-0737 | High | 8.0 | 2019-10-30 | A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to pe… |
CVE-2018-5742 | High | 7.5 | 2019-10-30 | While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind… |
CVE-2019-0210 | High | 7.5 | 2019-10-29 | In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data. |