Red Hat
Page 30 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000805 | High | 8.8 | 2018-10-08 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This… |
CVE-2018-17456 | Critical | 9.8 | 2018-10-06 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code executio… |
CVE-2018-11784 | Medium | 4.3 | 2018-10-04 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirectin… |
CVE-2018-17972 | Medium | 5.5 | 2018-10-03 | An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the… |
CVE-2018-14648 | High | 7.5 | 2018-09-28 | A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthentica… |
CVE-2018-17581 | Medium | 6.5 | 2018-09-28 | CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. |
CVE-2018-14650 | Medium | 5.9 | 2018-09-27 | It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any… |
CVE-2018-14634 | High | 7.8 | 2018-09-25 | An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged)… |
CVE-2018-11763 | Medium | 5.9 | 2018-09-25 | In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any c… |
CVE-2018-6054 | High | 8.8 | 2018-09-25 | Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. |
CVE-2018-6053 | Low | 3.3 | 2018-09-25 | Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing b… |
CVE-2018-6052 | Medium | 4.3 | 2018-09-25 | Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain referrer detai… |
CVE-2018-6051 | Medium | 4.3 | 2018-09-25 | XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote atta… |
CVE-2018-6050 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6049 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is grante… |
CVE-2018-6048 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a craft… |
CVE-2018-6047 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted… |
CVE-2018-6046 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6045 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a cr… |
CVE-2018-6043 | High | 8.8 | 2018-09-25 | Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary pr… |
CVE-2018-6042 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6041 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2018-6040 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a… |
CVE-2018-6039 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6038 | Medium | 6.5 | 2018-09-25 | Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6037 | Medium | 6.5 | 2018-09-25 | Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestu… |
CVE-2018-6036 | Medium | 6.5 | 2018-09-25 | Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page. |
CVE-2018-6035 | High | 8.8 | 2018-09-25 | Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a cr… |
CVE-2018-6034 | High | 8.1 | 2018-09-25 | Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted H… |
CVE-2018-6033 | High | 8.8 | 2018-09-25 | Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox v… |
CVE-2018-6032 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6031 | High | 8.8 | 2018-09-25 | Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2018-15967 | High | 7.5 | 2018-09-25 | Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-14647 | High | 7.5 | 2018-09-25 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks a… |
CVE-2018-14633 | High | 7.0 | 2018-09-25 | A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISC… |
CVE-2018-14645 | High | 7.5 | 2018-09-21 | A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a… |
CVE-2018-3830 | Medium | 6.1 | 2018-09-19 | Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive i… |
CVE-2018-17206 | Medium | 4.9 | 2018-09-19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue… |
CVE-2018-17205 | High | 7.5 | 2018-09-19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are a… |
CVE-2018-17204 | Medium | 4.3 | 2018-09-19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod… |
CVE-2018-17183 | High | 7.8 | 2018-09-19 | Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to pot… |
CVE-2018-14642 | Medium | 5.3 | 2018-09-18 | An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the b… |
CVE-2018-11781 | High | 7.8 | 2018-09-17 | Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. |
CVE-2017-15705 | Medium | 5.3 | 2018-09-17 | A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails… |
CVE-2018-14638 | High | 7.5 | 2018-09-14 | A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are… |
CVE-2018-10937 | Medium | 4.6 | 2018-09-11 | A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use t… |
CVE-2018-1127 | Medium | 4.2 | 2018-09-11 | Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few min… |
CVE-2018-1114 | Medium | 6.5 | 2018-09-11 | It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaus… |
CVE-2018-10935 | Medium | 6.5 | 2018-09-11 | A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort. |
CVE-2016-7066 | High | 7.8 | 2018-09-11 | It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to con… |
CVE-2016-7070 | High | 8.0 | 2018-09-11 | A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of… |
CVE-2016-7047 | Medium | 4.3 | 2018-09-11 | A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could… |
CVE-2018-14635 | Medium | 6.5 | 2018-09-10 | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address valid… |
CVE-2018-14620 | Medium | 4.7 | 2018-09-10 | The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could potentially allow an… |
CVE-2018-16802 | High | 7.8 | 2018-09-10 | An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling c… |
CVE-2016-7061 | Low | 3.5 | 2018-09-10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marki… |
CVE-2016-7056 | Medium | 5.5 | 2018-09-10 | A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. |
CVE-2016-7041 | Medium | 6.5 | 2018-09-10 | Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and re… |
CVE-2016-7035 | High | 8.8 | 2018-09-10 | An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pa… |
CVE-2016-7071 | High | 8.8 | 2018-09-10 | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated att… |
CVE-2016-7075 | High | 7.5 | 2018-09-10 | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker c… |
CVE-2018-5391 | High | 7.5 | 2018-09-06 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An… |
CVE-2018-14632 | High | 7.7 | 2018-09-06 | An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker ca… |
CVE-2018-14624 | High | 7.5 | 2018-09-06 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when r… |
CVE-2018-14618 | High | 7.5 | 2018-09-05 | curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the le… |
CVE-2018-16542 | Medium | 5.5 | 2018-09-05 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handl… |
CVE-2018-16541 | Medium | 5.5 | 2018-09-05 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the int… |
CVE-2018-16540 | High | 7.8 | 2018-09-05 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice h… |
CVE-2018-16539 | Medium | 5.5 | 2018-09-05 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose con… |
CVE-2016-1000232 | Medium | 5.3 | 2018-09-05 | NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Servic… |
CVE-2018-16511 | High | 7.8 | 2018-09-05 | An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply crafted PostScript to… |
CVE-2018-16509 | High | 7.8 | 2018-09-05 | An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be… |
CVE-2018-10930 | Medium | 6.5 | 2018-09-04 | A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the… |
CVE-2018-10929 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute… |
CVE-2018-10928 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volu… |
CVE-2018-10927 | High | 8.1 | 2018-09-04 | A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote… |
CVE-2018-10926 | High | 8.8 | 2018-09-04 | A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrar… |
CVE-2018-10923 | High | 8.1 | 2018-09-04 | It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use t… |
CVE-2018-10914 | Medium | 6.5 | 2018-09-04 | It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of se… |
CVE-2018-10913 | Medium | 6.5 | 2018-09-04 | An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existen… |
CVE-2018-10911 | High | 7.5 | 2018-09-04 | A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory fr… |
CVE-2018-10907 | High | 8.8 | 2018-09-04 | It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers u… |
CVE-2018-10904 | High | 8.8 | 2018-09-04 | It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats… |
CVE-2018-14627 | Medium | 5.3 | 2018-09-04 | The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are… |
CVE-2018-16435 | Medium | 5.5 | 2018-09-04 | Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overf… |
CVE-2018-16402 | Critical | 9.8 | 2018-09-03 | libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other… |
CVE-2018-14622 | High | 7.5 | 2018-08-30 | A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, wh… |
CVE-2018-10936 | High | 8.1 | 2018-08-30 | A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier wa… |
CVE-2018-15727 | Critical | 9.8 | 2018-08-29 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing… |
CVE-2018-12828 | Critical | 9.8 | 2018-08-29 | Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Successful exploitation could lead to privilege… |
CVE-2018-12827 | High | 7.5 | 2018-08-29 | Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12826 | High | 7.5 | 2018-08-29 | Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12825 | Critical | 9.8 | 2018-08-29 | Adobe Flash Player 30.0.0.134 and earlier have a security bypass vulnerability. Successful exploitation could lead to security mitigation bypass. |
CVE-2018-12824 | Medium | 5.9 | 2018-08-29 | Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-16062 | Medium | 5.5 | 2018-08-29 | dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read… |
CVE-2017-15429 | Medium | 6.1 | 2018-08-28 | Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTM… |
CVE-2017-15399 | High | 8.8 | 2018-08-28 | A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2017-15398 | Critical | 9.8 | 2018-08-28 | A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious se… |
CVE-2017-15396 | Medium | 6.5 | 2018-08-28 | A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.32… |
CVE-2017-15427 | Medium | 6.1 | 2018-08-28 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping… |