Red Hat
Page 29 of 74 — Red Hat CVEs from a corpus of 7350, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14352 | High | 8.0 | 2020-08-30 | A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository met… |
CVE-2019-4579 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the… |
CVE-2019-4533 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. IBM X-Force ID: 165589. |
CVE-2019-14904 | High | 7.3 | 2020-08-26 | A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checke… |
CVE-2020-10775 | Medium | 5.3 | 2020-08-24 | An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites an… |
CVE-2020-14356 | High | 7.8 | 2020-08-19 | A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user coul… |
CVE-2020-14324 | Critical | 9.1 | 2020-08-11 | A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be… |
CVE-2020-14313 | Medium | 4.3 | 2020-08-11 | An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a re… |
CVE-2020-14296 | High | 7.1 | 2020-08-11 | Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan a… |
CVE-2020-10780 | Medium | 6.3 | 2020-08-11 | Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once… |
CVE-2020-14325 | Critical | 9.1 | 2020-08-11 | Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-exist… |
CVE-2020-10783 | High | 8.3 | 2020-08-11 | Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to… |
CVE-2020-10779 | Medium | 6.5 | 2020-08-11 | Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. There… |
CVE-2020-10778 | Medium | 6.0 | 2020-08-11 | In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is… |
CVE-2020-10777 | Medium | 5.4 | 2020-08-11 | A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on… |
CVE-2020-9490 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the serv… |
CVE-2020-15136 | Medium | 6.5 | 2020-08-06 | In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS au… |
CVE-2020-15114 | High | 7.7 | 2020-08-06 | In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to i… |
CVE-2020-15115 | Medium | 5.8 | 2020-08-06 | etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of o… |
CVE-2020-14319 | Medium | 5.9 | 2020-08-03 | It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight checks are not inst… |
CVE-2020-14311 | Medium | 5.7 | 2020-07-31 | There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT3… |
CVE-2020-14310 | Medium | 5.7 | 2020-07-31 | There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it… |
CVE-2020-14337 | Medium | 5.8 | 2020-07-31 | A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attack… |
CVE-2020-14334 | High | 8.8 | 2020-07-31 | A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to gain complete cont… |
CVE-2020-10731 | Critical | 9.9 | 2020-07-31 | A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, a… |
CVE-2020-14316 | Critical | 9.9 | 2020-07-29 | A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation al… |
CVE-2020-15707 | Medium | 5.7 | 2020-07-29 | Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and… |
CVE-2020-15706 | Medium | 6.4 | 2020-07-29 | GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whil… |
CVE-2020-15705 | Medium | 6.4 | 2020-07-29 | GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel sig… |
CVE-2020-14307 | Medium | 6.5 | 2020-07-24 | A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed fr… |
CVE-2020-14297 | Medium | 6.5 | 2020-07-24 | A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the tim… |
CVE-2020-15719 | Medium | 4.2 | 2020-07-14 | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN e… |
CVE-2020-14300 | High | 8.8 | 2020-07-13 | The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/er… |
CVE-2020-14298 | High | 8.8 | 2020-07-13 | The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for C… |
CVE-2019-19338 | Medium | 5.5 | 2020-07-13 | A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of inst… |
CVE-2020-10756 | Medium | 6.5 | 2020-07-09 | An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routi… |
CVE-2020-7140 | Medium | 6.1 | 2020-07-08 | A security vulnerability in HPE IceWall SSO Dfw and Dgfw (Domain Gateway Option) could be exploited remotely to cause a remote cross-site scripting (XSS). HPE… |
CVE-2020-10730 | Medium | 6.5 | 2020-07-07 | A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Alt… |
CVE-2019-14900 | Medium | 6.5 | 2020-07-06 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit u… |
CVE-2020-10769 | Medium | 5.5 | 2020-06-26 | A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's mod… |
CVE-2020-10727 | Medium | 5.5 | 2020-06-26 | A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis… |
CVE-2020-10753 | Medium | 5.4 | 2020-06-26 | A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHead… |
CVE-2020-1727 | Medium | 6.4 | 2020-06-22 | A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wid… |
CVE-2019-3865 | Medium | 6.1 | 2020-06-22 | A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name fie… |
CVE-2020-10740 | Medium | 6.6 | 2020-06-22 | A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB… |
CVE-2019-14894 | High | 8.0 | 2020-06-22 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS sch… |
CVE-2020-10782 | Medium | 6.5 | 2020-06-18 | An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and expose… |
CVE-2018-16848 | Medium | 6.5 | 2020-06-15 | A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition… |
CVE-2020-10752 | High | 7.5 | 2020-06-12 | A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurr… |
CVE-2020-10705 | High | 7.5 | 2020-06-10 | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memor… |
CVE-2020-10755 | Medium | 6.5 | 2020-06-10 | An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-c… |
CVE-2020-10761 | Medium | 5.0 | 2020-06-09 | An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends… |
CVE-2020-10757 | High | 7.8 | 2020-06-09 | A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX… |
CVE-2020-7013 | High | 7.2 | 2020-06-03 | Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations coul… |
CVE-2020-10749 | Medium | 6.0 | 2020-06-03 | A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perfo… |
CVE-2020-10703 | Medium | 6.5 | 2020-06-02 | A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage p… |
CVE-2020-10737 | Medium | 6.3 | 2020-05-27 | A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhome… |
CVE-2020-10719 | Medium | 6.5 | 2020-05-26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an atta… |
CVE-2020-10751 | Medium | 6.1 | 2020-05-26 | A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single… |
CVE-2020-10711 | Medium | 5.9 | 2020-05-22 | A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Se… |
CVE-2020-1695 | High | 7.5 | 2020-05-19 | A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation… |
CVE-2020-1758 | Medium | 5.3 | 2020-05-15 | A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Thi… |
CVE-2020-12685 | Medium | 6.1 | 2020-05-15 | XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data… |
CVE-2020-10744 | Medium | 5.0 | 2020-05-15 | An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The pro… |
CVE-2020-1714 | High | 8.8 | 2020-05-13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker… |
CVE-2020-1718 | High | 7.1 | 2020-05-12 | A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the applicatio… |
CVE-2020-12826 | Medium | 5.3 | 2020-05-12 | A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits… |
CVE-2020-1746 | Medium | 5.0 | 2020-05-12 | A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible… |
CVE-2020-10706 | Medium | 6.3 | 2020-05-12 | A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attac… |
CVE-2020-1724 | Medium | 4.3 | 2020-05-11 | A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a prev… |
CVE-2020-1698 | Medium | 5.0 | 2020-05-11 | A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat… |
CVE-2020-10685 | Medium | 5.0 | 2020-05-11 | A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Towe… |
CVE-2020-10690 | Medium | 6.5 | 2020-05-08 | There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (… |
CVE-2019-14898 | High | 7.0 | 2020-05-08 | The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause… |
CVE-2019-10170 | Medium | 6.6 | 2020-05-08 | A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker wi… |
CVE-2019-10169 | Medium | 6.6 | 2020-05-08 | A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated att… |
CVE-2020-10704 | High | 7.5 | 2020-05-06 | A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Control… |
CVE-2020-10693 | Medium | 5.3 | 2020-05-06 | A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if… |
CVE-2020-10700 | Medium | 5.3 | 2020-05-04 | A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a… |
CVE-2020-10686 | Medium | 4.1 | 2020-05-04 | A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could… |
CVE-2020-1732 | Medium | 4.2 | 2020-05-04 | A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads… |
CVE-2020-10691 | Medium | 5.2 | 2020-04-30 | An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a coll… |
CVE-2020-12458 | Medium | 5.5 | 2020-04-29 | An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are wo… |
CVE-2020-12430 | Medium | 6.5 | 2020-04-28 | An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomain… |
CVE-2020-1745 | High | 8.6 | 2020-04-28 | A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before… |
CVE-2020-1762 | High | 7.0 | 2020-04-27 | An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could… |
CVE-2020-1722 | Medium | 5.3 | 2020-04-27 | A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing proce… |
CVE-2020-1741 | Medium | 5.9 | 2020-04-24 | A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installati… |
CVE-2020-1760 | Medium | 5.8 | 2020-04-23 | A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks du… |
CVE-2020-10712 | High | 7.0 | 2020-04-22 | A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an… |
CVE-2020-1757 | High | 8.1 | 2020-04-21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final… |
CVE-2020-1699 | High | 7.5 | 2020-04-21 | A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions… |
CVE-2020-1751 | Medium | 5.1 | 2020-04-17 | An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not p… |
CVE-2020-11868 | High | 7.5 | 2020-04-17 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoof… |
CVE-2020-1730 | Medium | 5.3 | 2020-04-13 | A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could… |
CVE-2020-1759 | Medium | 6.4 | 2020-04-13 | A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure… |
CVE-2020-11669 | Medium | 5.5 | 2020-04-10 | An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for… |
CVE-2020-2732 | Medium | 5.8 | 2020-04-08 | A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circum… |
CVE-2020-1728 | Medium | 4.8 | 2020-04-06 | A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP securit… |
CVE-2020-10689 | Medium | 6.4 | 2020-04-03 | A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this fl… |