Red Hat
Page 23 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2019-9515 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to t… |
CVE-2019-9514 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an in… |
CVE-2019-9513 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and con… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2019-11042 | High | 7.1 | 2019-08-09 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 a… |
CVE-2019-11041 | High | 7.1 | 2019-08-09 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 a… |
CVE-2019-14433 | Medium | 6.5 | 2019-08-09 | An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fa… |
CVE-2019-14744 | High | 7.8 | 2019-08-07 | In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to… |
CVE-2019-10176 | Medium | 4.2 | 2019-08-02 | A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain… |
CVE-2019-10171 | High | 7.5 | 2019-08-02 | It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be… |
CVE-2019-10168 | High | 7.8 | 2019-08-02 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argum… |
CVE-2019-10167 | High | 7.8 | 2019-08-02 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the progra… |
CVE-2019-10166 | High | 7.8 | 2019-08-02 | It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML()… |
CVE-2019-14494 | High | 7.5 | 2019-08-01 | An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. |
CVE-2019-3890 | High | 8.1 | 2019-08-01 | It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential informatio… |
CVE-2019-3884 | Medium | 5.4 | 2019-08-01 | A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is abl… |
CVE-2018-10899 | High | 8.1 | 2019-08-01 | A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured… |
CVE-2015-7559 | Low | 2.7 | 2019-08-01 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a comprom… |
CVE-2014-8183 | High | 7.4 | 2019-08-01 | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access… |
CVE-2019-10198 | Medium | 6.5 | 2019-07-31 | An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which perfo… |
CVE-2019-10182 | High | 8.2 | 2019-07-31 | It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into… |
CVE-2019-10357 | Medium | 4.3 | 2019-07-31 | A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited inform… |
CVE-2019-10356 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to ex… |
CVE-2019-10355 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary… |
CVE-2019-10165 | Low | 2.3 | 2019-07-30 | OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2019-10156 | Medium | 5.4 | 2019-07-30 | A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclos… |
CVE-2019-10153 | Medium | 5.0 | 2019-07-30 | A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm… |
CVE-2019-10142 | High | 7.1 | 2019-07-30 | A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioc… |
CVE-2019-10141 | High | 8.3 | 2019-07-30 | A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in… |
CVE-2018-16871 | High | 7.5 | 2019-07-30 | A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS… |
CVE-2019-11775 | High | 7.4 | 2019-07-30 | All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning -… |
CVE-2019-14439 | High | 7.5 | 2019-07-30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for… |
CVE-2019-14379 | Critical | 9.8 | 2019-07-29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manage… |
CVE-2019-10744 | Critical | 9.1 | 2019-07-26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of… |
CVE-2019-10184 | High | 7.5 | 2019-07-25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests withou… |
CVE-2019-2879 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.16 and prior. Easily exploitab… |
CVE-2019-2834 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2830 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2826 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Roles). Supported versions that are affected are 8.0.16 and prior… |
CVE-2019-2819 | Medium | 5.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Audit). Supported versions that are affected are 5.6.44 and prior… |
CVE-2019-2816 | Medium | 4.8 | 2019-07-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221… |
CVE-2019-2815 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2814 | Low | 2.2 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.16 and prior. Difficult to exp… |
CVE-2019-2812 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2811 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.16 and p… |
CVE-2019-2810 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2808 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2805 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44 and prior, 5.7.26 a… |
CVE-2019-2803 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2802 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2801 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: FTS). Supported versions that are affected are 8.0.16 and prior. Easily expl… |
CVE-2019-2800 | High | 7.1 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.16 and prior. Eas… |
CVE-2019-2798 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitab… |
CVE-2019-2797 | Medium | 4.2 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.7.26 and prior and 8.0… |
CVE-2019-2796 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.16 and prior. Easil… |
CVE-2019-2795 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 8.0.16 and prior. Easily… |
CVE-2019-2789 | Low | 2.7 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.16 and p… |
CVE-2019-2786 | Low | 3.4 | 2019-07-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 8u212, 1… |
CVE-2019-2785 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.16 and prior. Easily exploitab… |
CVE-2019-2784 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 8.0.16 and prior. Easily expl… |
CVE-2019-2780 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Components / Services). Supported versions that are affected are 8.0.16 and… |
CVE-2019-2778 | Medium | 5.4 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.26 and p… |
CVE-2019-2774 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8… |
CVE-2019-2769 | Medium | 5.3 | 2019-07-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221… |
CVE-2019-2762 | Medium | 5.3 | 2019-07-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221… |
CVE-2019-2757 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8… |
CVE-2019-2755 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.25 and prior and… |
CVE-2019-2752 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.16 and prior. Easily… |
CVE-2019-2740 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and… |
CVE-2019-2739 | Medium | 5.1 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and p… |
CVE-2019-2738 | Low | 3.1 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Compiling). Supported versions that are affected are 5.6.44 and prior, 5.7… |
CVE-2019-9959 | Medium | 6.5 | 2019-07-22 | The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making i… |
CVE-2019-11989 | Medium | 5.9 | 2019-07-19 | A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of service. The versions… |
CVE-2019-1010238 | Critical | 9.8 | 2019-07-19 | Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is… |
CVE-2019-10354 | Medium | 4.3 | 2019-07-17 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, by… |
CVE-2019-13272 | High | 7.8 | 2019-07-17 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relati… |
CVE-2019-13616 | High | 8.1 | 2019-07-16 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_So… |
CVE-2019-3889 | Medium | 5.4 | 2019-07-11 | A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 a… |
CVE-2019-12527 | High | 8.8 | 2019-07-11 | An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decod… |
CVE-2019-10194 | Medium | 5.5 | 2019-07-11 | Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclose… |
CVE-2019-10193 | High | 7.2 | 2019-07-11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By… |
CVE-2019-10192 | High | 7.2 | 2019-07-11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By c… |
CVE-2018-11307 | Critical | 9.8 | 2019-07-09 | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltrat… |
CVE-2019-13314 | High | 7.8 | 2019-07-05 | virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root-password option to… |
CVE-2019-13313 | High | 7.8 | 2019-07-05 | libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line. |
CVE-2019-10183 | Low | 3.2 | 2019-07-03 | Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option acce… |
CVE-2019-10137 | High | 8.1 | 2019-07-02 | A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated at… |
CVE-2019-10136 | Medium | 4.3 | 2019-07-02 | It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set… |
CVE-2019-10177 | Medium | 6.5 | 2019-06-27 | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly… |
CVE-2019-10164 | High | 8.8 | 2019-06-26 | PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack… |
CVE-2019-12817 | High | 7.0 | 2019-06-25 | arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one anoth… |
CVE-2019-12384 | Medium | 5.9 | 2019-06-24 | FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from pol… |
CVE-2019-3896 | High | 7.0 | 2019-06-19 | A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege esca… |
CVE-2019-11479 | High | 7.5 | 2019-06-19 | Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly m… |
CVE-2019-11478 | Medium | 5.3 | 2019-06-19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP S… |
CVE-2019-11477 | High | 7.5 | 2019-06-19 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Ackn… |
CVE-2019-11040 | Critical | 9.1 | 2019-06-19 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 a… |
CVE-2019-11039 | Critical | 9.1 | 2019-06-19 | Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer… |