Red Hat
Page 33 of 74 — Red Hat CVEs from a corpus of 7351, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14896 | Critical | 9.8 | 2019-11-27 | A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a d… |
CVE-2019-14867 | High | 8.8 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function… |
CVE-2019-10195 | Medium | 6.5 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch… |
CVE-2019-14842 | Critical | 9.8 | 2019-11-26 | Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk o… |
CVE-2019-14856 | Medium | 6.5 | 2019-11-26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None |
CVE-2019-14890 | High | 8.4 | 2019-11-26 | A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RH… |
CVE-2011-3632 | High | 7.1 | 2019-11-26 | Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks. |
CVE-2011-3631 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calc… |
CVE-2011-3630 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A… |
CVE-2011-3609 | Medium | 6.5 | 2019-11-26 | A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example vi… |
CVE-2011-3606 | Medium | 5.4 | 2019-11-26 | A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a… |
CVE-2019-14825 | Low | 2.7 | 2019-11-25 | A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discov… |
CVE-2019-10224 | Medium | 4.6 | 2019-11-25 | A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive inf… |
CVE-2019-10217 | Medium | 6.5 | 2019-11-25 | A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are… |
CVE-2019-13723 | High | 8.8 | 2019-11-25 | Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploi… |
CVE-2019-10213 | Medium | 6.5 | 2019-11-25 | OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or… |
CVE-2012-5644 | Medium | 5.5 | 2019-11-25 | libuser has information disclosure when moving user's home directory |
CVE-2019-10207 | Medium | 5.5 | 2019-11-25 | A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local acces… |
CVE-2012-5630 | Medium | 6.3 | 2019-11-25 | libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. |
CVE-2012-5521 | Medium | 6.5 | 2019-11-25 | quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal |
CVE-2019-14822 | High | 7.1 | 2019-11-25 | A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due… |
CVE-2019-14891 | Medium | 5.0 | 2019-11-25 | A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) pr… |
CVE-2019-14815 | High | 7.8 | 2019-11-25 | A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver. |
CVE-2019-10214 | Medium | 5.9 | 2019-11-25 | The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Pla… |
CVE-2019-10174 | High | 8.8 | 2019-11-25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke priva… |
CVE-2019-11287 | High | 7.5 | 2019-11-23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versio… |
CVE-2019-11291 | Medium | 4.8 | 2019-11-22 | Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prio… |
CVE-2012-0877 | High | 7.5 | 2019-11-22 | PyXML: Hash table collisions CPU usage Denial of Service |
CVE-2015-7810 | Medium | 4.7 | 2019-11-22 | libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files |
CVE-2015-5694 | Medium | 6.5 | 2019-11-22 | Designate does not enforce the DNS protocol limit concerning record set sizes |
CVE-2015-1780 | Medium | 6.5 | 2019-11-22 | oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center |
CVE-2014-3585 | Critical | 9.8 | 2019-11-22 | redhat-upgrade-tool: Does not check GPG signatures when upgrading versions |
CVE-2019-10206 | Medium | 6.5 | 2019-11-22 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding… |
CVE-2019-10203 | Medium | 4.3 | 2019-11-22 | PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying… |
CVE-2018-10854 | Medium | 5.4 | 2019-11-22 | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping del… |
CVE-2014-3700 | Critical | 9.8 | 2019-11-21 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data |
CVE-2014-0084 | Medium | 5.5 | 2019-11-21 | Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly. |
CVE-2012-3460 | Critical | 9.8 | 2019-11-21 | cumin: At installation postgresql database user created without password |
CVE-2013-1817 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. |
CVE-2013-1816 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted reques… |
CVE-2012-6136 | Medium | 5.5 | 2019-11-20 | tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. |
CVE-2012-6135 | High | 7.5 | 2019-11-19 | RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. |
CVE-2011-4967 | High | 7.5 | 2019-11-19 | tog-Pegasus has a package hash collision DoS vulnerability |
CVE-2014-5118 | Medium | 5.5 | 2019-11-18 | Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2019-19081 | Medium | 5.9 | 2019-11-18 | A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attacke… |
CVE-2019-19076 | Medium | 5.9 | 2019-11-18 | A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to… |
CVE-2019-19072 | Medium | 4.4 | 2019-11-18 | A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of… |
CVE-2019-19068 | Medium | 4.6 | 2019-11-18 | A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows atta… |
CVE-2019-19066 | Medium | 4.7 | 2019-11-18 | A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of serv… |
CVE-2019-19062 | Medium | 4.7 | 2019-11-18 | A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (me… |
CVE-2019-19012 | Critical | 9.8 | 2019-11-17 | An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this… |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2016-5285 | High | 7.5 | 2019-11-15 | A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMAC… |
CVE-2014-0023 | High | 7.8 | 2019-11-15 | OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution |
CVE-2018-12207 | Medium | 6.5 | 2019-11-14 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentiall… |
CVE-2019-11135 | Medium | 6.5 | 2019-11-14 | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via… |
CVE-2019-0155 | High | 7.8 | 2019-11-14 | Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R)… |
CVE-2019-14818 | High | 7.5 | 2019-11-14 | A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, o… |
CVE-2012-1168 | High | 8.2 | 2019-11-14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified. |
CVE-2012-1156 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has users' private files included in course backups |
CVE-2012-1155 | High | 7.5 | 2019-11-14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the… |
CVE-2011-1145 | High | 7.8 | 2019-11-14 | The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in t… |
CVE-2010-4664 | High | 8.8 | 2019-11-13 | In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privilege… |
CVE-2010-4661 | High | 7.8 | 2019-11-13 | udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules. |
CVE-2010-4657 | High | 7.5 | 2019-11-13 | PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak in… |
CVE-2014-8167 | Medium | 5.9 | 2019-11-13 | vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack |
CVE-2014-3655 | Medium | 4.3 | 2019-11-13 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
CVE-2014-3592 | Medium | 6.1 | 2019-11-13 | OpenShift Origin: Improperly validated team names could allow stored XSS attacks |
CVE-2010-3857 | Medium | 6.1 | 2019-11-12 | JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter. |
CVE-2014-3599 | Medium | 6.5 | 2019-11-12 | HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy |
CVE-2011-2897 | Critical | 9.8 | 2019-11-12 | gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw |
CVE-2009-3552 | Low | 3.1 | 2019-11-09 | In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a W… |
CVE-2019-3866 | Medium | 5.5 | 2019-11-08 | An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable… |
CVE-2019-14860 | Medium | 6.5 | 2019-11-08 | It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to c… |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2019-10222 | High | 7.5 | 2019-11-08 | A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW serve… |
CVE-2019-10219 | Medium | 6.1 | 2019-11-08 | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious cod… |
CVE-2013-1820 | Medium | 5.5 | 2019-11-08 | tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. |
CVE-2008-5083 | Medium | 6.5 | 2019-11-08 | In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. |
CVE-2008-3278 | High | 7.8 | 2019-11-07 | frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/… |
CVE-2019-18811 | Medium | 5.5 | 2019-11-07 | A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of serv… |
CVE-2019-18805 | Critical | 9.8 | 2019-11-07 | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_upd… |
CVE-2016-1000037 | Medium | 6.1 | 2019-11-06 | Pagure: XSS possible in file attachment endpoint |
CVE-2014-8181 | Medium | 5.5 | 2019-11-06 | The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace. |
CVE-2016-4983 | Low | 3.3 | 2019-11-05 | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. |
CVE-2013-5123 | Medium | 5.9 | 2019-11-05 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-… |
CVE-2010-2222 | High | 7.5 | 2019-11-05 | The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer derefere… |
CVE-2013-5661 | Medium | 5.9 | 2019-11-05 | Cache Poisoning issue exists in DNS Response Rate Limiting. |
CVE-2013-6461 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits |
CVE-2013-6460 | Medium | 6.5 | 2019-11-05 | Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents |
CVE-2016-1000002 | Low | 2.4 | 2019-11-05 | gdm3 3.14.2 and possibly later has an information leak before screen lock |
CVE-2019-10223 | Medium | 6.5 | 2019-11-05 | A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled anno… |
CVE-2013-4374 | High | 7.1 | 2019-11-04 | An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files. |
CVE-2017-5333 | High | 7.8 | 2019-11-04 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of s… |
CVE-2017-5332 | High | 7.8 | 2019-11-04 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denia… |
CVE-2015-8980 | Critical | 9.8 | 2019-11-04 | The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. |
CVE-2013-4409 | Critical | 9.8 | 2019-11-04 | An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. |
CVE-2013-4251 | High | 7.8 | 2019-11-04 | The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. |
CVE-2013-4280 | Medium | 5.5 | 2019-11-04 | Insecure temporary file vulnerability in RedHat vsdm 4.9.6. |