Red Hat
Page 37 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5345 | High | 7.8 | 2018-01-12 | A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code… |
CVE-2014-0087 | High | 8.8 | 2018-01-11 | The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remot… |
CVE-2017-12189 | High | 7.8 | 2018-01-10 | It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could resul… |
CVE-2017-17485 | Critical | 9.8 | 2018-01-10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2017-7559 | Medium | 6.1 | 2018-01-10 | In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and i… |
CVE-2017-7536 | High | 7.0 | 2018-01-10 | In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to acc… |
CVE-2018-4871 | High | 7.5 | 2018-01-09 | An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is pa… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2017-15129 | Medium | 4.7 | 2018-01-09 | A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_… |
CVE-2014-1859 | Medium | 5.5 | 2018-01-08 | (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to w… |
CVE-2013-4364 | High | 7.8 | 2018-01-08 | (1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to ha… |
CVE-2017-18017 | Critical | 9.8 | 2018-01-03 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a den… |
CVE-2014-8119 | High | 7.5 | 2017-12-29 | The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path exp… |
CVE-2014-0121 | Critical | 9.8 | 2017-12-29 | The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter. |
CVE-2014-0120 | High | 8.8 | 2017-12-29 | Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for re… |
CVE-2016-3695 | Medium | 5.5 | 2017-12-29 | The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial o… |
CVE-2017-16818 | Medium | 6.5 | 2017-12-20 | RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveragi… |
CVE-2013-6465 | Medium | 5.4 | 2017-12-19 | Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vec… |
CVE-2017-15104 | High | 7.8 | 2017-12-18 | An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could r… |
CVE-2017-15103 | High | 8.8 | 2017-12-18 | A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to… |
CVE-2017-16997 | High | 7.8 | 2017-12-18 | elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE… |
CVE-2017-17405 | High | 8.8 | 2017-12-15 | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a lo… |
CVE-2017-11305 | Medium | 6.5 | 2017-12-13 | A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings preference file when a u… |
CVE-2017-1000407 | High | 7.4 | 2017-12-11 | The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel p… |
CVE-2014-3250 | Medium | 6.5 | 2017-12-11 | The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain s… |
CVE-2017-3114 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is p… |
CVE-2017-3112 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is p… |
CVE-2017-11225 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Prime… |
CVE-2017-11215 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Prime… |
CVE-2017-11213 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is p… |
CVE-2017-10906 | Critical | 9.8 | 2017-12-08 | Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary comman… |
CVE-2017-1000410 | High | 7.5 | 2017-12-07 | The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse… |
CVE-2017-15121 | Medium | 5.5 | 2017-12-07 | A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned… |
CVE-2017-11282 | Critical | 9.8 | 2017-12-01 | Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. T… |
CVE-2017-11281 | Critical | 9.8 | 2017-12-01 | Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploitation could lead to arbitrary code execu… |
CVE-2017-15116 | Medium | 5.5 | 2017-11-30 | The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference). |
CVE-2017-15275 | High | 7.5 | 2017-11-27 | Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. |
CVE-2017-14746 | Critical | 9.8 | 2017-11-27 | Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. |
CVE-2017-15114 | High | 8.1 | 2017-11-27 | When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd… |
CVE-2017-15100 | Medium | 6.1 | 2017-11-27 | An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page, when clicking on the "chart" button… |
CVE-2017-7550 | Critical | 9.8 | 2017-11-21 | A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could… |
CVE-2017-3157 | Medium | 5.5 | 2017-11-20 | By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's… |
CVE-2017-15102 | Medium | 6.3 | 2017-11-15 | The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a c… |
CVE-2016-8610 | High | 7.5 | 2017-11-13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets… |
CVE-2015-7501 | Critical | 9.8 | 2017-11-09 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x… |
CVE-2017-15087 | High | 7.5 | 2017-11-08 | It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6. |
CVE-2017-15086 | High | 7.4 | 2017-11-08 | It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6. |
CVE-2017-15085 | Medium | 5.9 | 2017-11-08 | It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6. |
CVE-2015-7529 | High | 7.8 | 2017-11-06 | sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a te… |
CVE-2017-16541 | Medium | 6.5 | 2017-11-04 | Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors invol… |
CVE-2017-1000256 | High | 8.1 | 2017-10-31 | libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate S… |
CVE-2017-5121 | High | 8.8 | 2017-10-27 | Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary… |
CVE-2017-5120 | Medium | 6.5 | 2017-10-27 | Inappropriate use of www mismatch redirects in browser navigation in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Andr… |
CVE-2017-5118 | Medium | 4.3 | 2017-10-27 | Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javas… |
CVE-2017-5116 | High | 8.8 | 2017-10-27 | Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arb… |
CVE-2017-5114 | High | 8.8 | 2017-10-27 | Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac, and 61.0.3163.81 for Android, allowed a remo… |
CVE-2017-5113 | High | 8.8 | 2017-10-27 | Math overflow in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentiall… |
CVE-2017-5111 | High | 8.8 | 2017-10-27 | A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit memory corruptio… |
CVE-2017-5110 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux… |
CVE-2017-5109 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remo… |
CVE-2017-5108 | High | 8.8 | 2017-10-27 | Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modif… |
CVE-2017-5107 | Medium | 5.3 | 2017-10-27 | A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cr… |
CVE-2017-5106 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5105 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5104 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via… |
CVE-2017-5103 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensit… |
CVE-2017-5102 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potential… |
CVE-2017-5101 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of t… |
CVE-2017-5100 | High | 8.8 | 2017-10-27 | A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
CVE-2017-5098 | High | 8.8 | 2017-10-27 | A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory… |
CVE-2017-5095 | High | 8.8 | 2017-10-27 | Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption v… |
CVE-2017-5094 | Medium | 6.5 | 2017-10-27 | Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to poten… |
CVE-2017-5093 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote att… |
CVE-2017-5091 | High | 8.8 | 2017-10-27 | A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac allowed a remote attacker to perform an out of bounds… |
CVE-2017-5089 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted d… |
CVE-2017-5088 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a… |
CVE-2017-5087 | High | 8.8 | 2017-10-27 | A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perf… |
CVE-2017-5086 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via… |
CVE-2017-5083 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attack… |
CVE-2017-5081 | Low | 3.3 | 2017-10-27 | Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed… |
CVE-2017-5079 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attack… |
CVE-2017-5078 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote atta… |
CVE-2017-5077 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a… |
CVE-2017-5076 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote a… |
CVE-2017-5075 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowe… |
CVE-2017-5073 | High | 8.8 | 2017-10-27 | Use after free in print preview in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote att… |
CVE-2017-5071 | Medium | 6.3 | 2017-10-27 | Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remo… |
CVE-2017-5070 | High | 8.8 | 2017-10-27 | Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arb… |
CVE-2017-5069 | Medium | 6.1 | 2017-10-27 | Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowe… |
CVE-2017-5068 | High | 7.5 | 2017-10-27 | Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condi… |
CVE-2017-5067 | Medium | 6.5 | 2017-10-27 | An insufficient watchdog timer in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents… |
CVE-2017-5066 | Medium | 6.5 | 2017-10-27 | Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029… |
CVE-2017-5065 | Medium | 4.7 | 2017-10-27 | Lack of an appropriate action on page navigation in Blink in Google Chrome prior to 58.0.3029.81 for Windows and Mac allowed a remote attacker to potentially c… |
CVE-2017-5063 | High | 8.8 | 2017-10-27 | A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perfo… |
CVE-2017-5062 | High | 8.8 | 2017-10-27 | A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to… |
CVE-2017-5061 | Medium | 5.3 | 2017-10-27 | A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibo… |
CVE-2017-5060 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote a… |
CVE-2017-5059 | High | 8.8 | 2017-10-27 | Type confusion in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentia… |
CVE-2017-5057 | High | 8.8 | 2017-10-27 | Type confusion in PDFium in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to perform… |
CVE-2017-5056 | High | 8.8 | 2017-10-27 | A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to perf… |