Red Hat
Page 39 of 74 — Red Hat CVEs from a corpus of 7351, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-2531 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7… |
CVE-2019-2530 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.13 and prior. Easil… |
CVE-2019-2529 | Medium | 6.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.2… |
CVE-2019-2510 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and pr… |
CVE-2019-2503 | Medium | 6.4 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling). Supported versions that are affected are 5.6.42 and pr… |
CVE-2019-2481 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.2… |
CVE-2019-2455 | Medium | 6.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.42 and prior, 5.7.24 a… |
CVE-2019-2449 | Low | 3.1 | 2019-01-16 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). The supported version that is affected is Java SE: 8u192. Difficult to exp… |
CVE-2019-2436 | Medium | 5.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.13 and prior. Eas… |
CVE-2019-2434 | Medium | 6.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.7.24 and prior and 8.0.1… |
CVE-2019-2422 | Low | 3.1 | 2019-01-16 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1… |
CVE-2019-2420 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.24 and prior and 8… |
CVE-2018-14662 | Medium | 5.7 | 2019-01-15 | It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph disk encryp… |
CVE-2018-16846 | Medium | 6.5 | 2019-01-15 | It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices. |
CVE-2019-3811 | Medium | 5.2 | 2019-01-15 | A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty str… |
CVE-2018-16888 | Medium | 4.7 | 2019-01-14 | It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged u… |
CVE-2018-16886 | High | 8.1 | 2019-01-14 | etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and… |
CVE-2018-16887 | Medium | 5.4 | 2019-01-13 | A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is abl… |
CVE-2018-20699 | Medium | 4.9 | 2019-01-12 | Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus v… |
CVE-2018-16865 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entrie… |
CVE-2018-16864 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program w… |
CVE-2018-16866 | Low | 3.3 | 2019-01-11 | An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw… |
CVE-2019-6133 | Medium | 6.7 | 2019-01-11 | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are… |
CVE-2018-20685 | Medium | 5.3 | 2019-01-10 | In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact… |
CVE-2017-1002157 | Critical | 9.8 | 2019-01-10 | modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. |
CVE-2017-1002152 | Medium | 6.1 | 2019-01-10 | Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles. |
CVE-2018-6179 | Medium | 6.5 | 2019-01-09 | Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced… |
CVE-2018-6178 | Medium | 4.3 | 2019-01-09 | Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious ex… |
CVE-2018-6175 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6174 | High | 8.8 | 2019-01-09 | Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2018-6173 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6172 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6170 | High | 8.8 | 2019-01-09 | A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2018-6169 | Medium | 6.5 | 2019-01-09 | Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwant… |
CVE-2018-6167 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6166 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6165 | Medium | 6.5 | 2019-01-09 | Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2018-6164 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2018-6163 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6162 | High | 8.8 | 2019-01-09 | Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2018-6158 | High | 7.5 | 2019-01-09 | A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6153 | High | 8.8 | 2019-01-09 | A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds… |
CVE-2018-6151 | High | 8.8 | 2019-01-09 | Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2018-6147 | Medium | 5.5 | 2019-01-09 | Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information… |
CVE-2018-6144 | High | 8.8 | 2019-01-09 | Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. |
CVE-2018-6143 | Medium | 6.5 | 2019-01-09 | Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6141 | High | 8.8 | 2019-01-09 | Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to… |
CVE-2018-6140 | High | 8.8 | 2019-01-09 | Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to insta… |
CVE-2018-6139 | High | 8.8 | 2019-01-09 | Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a… |
CVE-2018-6137 | Medium | 6.5 | 2019-01-09 | CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6135 | Medium | 6.5 | 2019-01-09 | Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform do… |
CVE-2018-6133 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6127 | Critical | 9.6 | 2019-01-09 | Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2018-6126 | High | 8.8 | 2019-01-09 | A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6124 | High | 8.8 | 2019-01-09 | Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit object corruption via a craf… |
CVE-2018-6123 | Medium | 6.5 | 2019-01-09 | A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6120 | High | 8.8 | 2019-01-09 | An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attac… |
CVE-2018-6117 | Medium | 6.5 | 2019-01-09 | Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memor… |
CVE-2018-6114 | Medium | 6.5 | 2019-01-09 | Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via… |
CVE-2018-6113 | Medium | 6.5 | 2019-01-09 | Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofi… |
CVE-2018-6112 | Medium | 4.3 | 2019-01-09 | Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass navigation restric… |
CVE-2018-6111 | High | 8.8 | 2019-01-09 | An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
CVE-2018-6110 | Medium | 5.4 | 2019-01-09 | Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTM… |
CVE-2018-6109 | Medium | 6.5 | 2019-01-09 | readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0… |
CVE-2018-6106 | High | 8.8 | 2019-01-09 | An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object… |
CVE-2018-6100 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoof… |
CVE-2018-6097 | Medium | 6.5 | 2019-01-09 | Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen withou… |
CVE-2018-6096 | Medium | 6.5 | 2019-01-09 | A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscur… |
CVE-2018-6093 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6091 | Medium | 6.5 | 2019-01-09 | Service Workers can intercept any request made by an <embed> or <object> tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to… |
CVE-2018-6084 | High | 7.8 | 2019-01-09 | Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
CVE-2018-6056 | High | 8.8 | 2019-01-09 | Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute arbitrary code insi… |
CVE-2018-17470 | High | 7.4 | 2019-01-09 | A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2018-17461 | High | 8.8 | 2019-01-09 | An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
CVE-2018-17459 | Medium | 6.5 | 2019-01-09 | Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox… |
CVE-2018-17458 | High | 8.8 | 2019-01-09 | An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code… |
CVE-2018-16088 | Medium | 6.5 | 2019-01-09 | A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrary files with no use… |
CVE-2018-16084 | Medium | 6.1 | 2019-01-09 | The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user to perform certain… |
CVE-2018-16083 | High | 8.8 | 2019-01-09 | An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds m… |
CVE-2018-16082 | Medium | 6.5 | 2019-01-09 | An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2018-16081 | High | 7.4 | 2019-01-09 | Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install… |
CVE-2018-16079 | Medium | 5.3 | 2019-01-09 | A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents o… |
CVE-2018-16078 | Medium | 6.5 | 2019-01-09 | Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information… |
CVE-2018-16076 | High | 8.8 | 2019-01-09 | Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. |
CVE-2018-16071 | High | 8.8 | 2019-01-09 | A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
CVE-2018-16068 | Critical | 9.6 | 2019-01-09 | Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2018-16067 | Medium | 6.5 | 2019-01-09 | A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16066 | Medium | 6.5 | 2019-01-09 | A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-16065 | High | 8.8 | 2019-01-09 | A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code in… |
CVE-2016-9651 | High | 8.8 | 2019-01-09 | A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary co… |
CVE-2019-0542 | High | 8.8 | 2019-01-09 | A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." Thi… |
CVE-2018-16885 | Medium | 4.7 | 2019-01-03 | A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which c… |
CVE-2018-16876 | Medium | 5.3 | 2019-01-03 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible d… |
CVE-2018-16879 | Critical | 9.8 | 2019-01-03 | Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery worker… |
CVE-2018-20662 | Medium | 6.5 | 2019-01-03 | In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong r… |
CVE-2018-19362 | Critical | 9.8 | 2019-01-02 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from po… |
CVE-2018-19361 | Critical | 9.8 | 2019-01-02 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic… |
CVE-2018-19360 | Critical | 9.8 | 2019-01-02 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from… |
CVE-2018-14721 | Critical | 10.0 | 2019-01-02 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block t… |
CVE-2018-14720 | Critical | 9.8 | 2019-01-02 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK c… |