Red Hat
Page 54 of 74 — Red Hat CVEs from a corpus of 7350, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4978 | High | 7.2 | 2016-09-27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Art… |
CVE-2016-5406 | High | 8.8 | 2016-09-26 | The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveragin… |
CVE-2016-4993 | Medium | 6.1 | 2016-09-26 | CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, all… |
CVE-2016-3110 | High | 7.5 | 2016-09-26 | mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message conta… |
CVE-2016-6340 | High | 8.4 | 2016-09-22 | The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determin… |
CVE-2016-6322 | High | 8.4 | 2016-09-22 | Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for /etc/qci/answers, which allows local users to obtain the root password for the dep… |
CVE-2016-7166 | Medium | 5.5 | 2016-09-21 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption a… |
CVE-2016-7163 | High | 7.8 | 2016-09-21 | Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which trigg… |
CVE-2016-5844 | Medium | 6.5 | 2016-09-21 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. |
CVE-2016-5418 | High | 7.5 | 2016-09-21 | The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to a… |
CVE-2016-4809 | High | 7.5 | 2016-09-21 | The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of… |
CVE-2016-4302 | High | 7.8 | 2016-09-21 | Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbit… |
CVE-2016-4300 | High | 7.8 | 2016-09-21 | Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitr… |
CVE-2016-6662 | Critical | 9.8 | 2016-09-20 | Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Perco… |
CVE-2016-5422 | High | 8.8 | 2016-09-07 | The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows… |
CVE-2016-7034 | High | 8.8 | 2016-09-07 | The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, wh… |
CVE-2016-7033 | Medium | 6.1 | 2016-09-07 | Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitra… |
CVE-2016-6346 | High | 7.5 | 2016-09-07 | RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2016-6345 | Medium | 6.5 | 2016-09-07 | RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. |
CVE-2016-6344 | Medium | 5.3 | 2016-09-07 | Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obta… |
CVE-2016-2183 | High | 7.5 | 2016-09-01 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four bill… |
CVE-2016-5383 | High | 8.8 | 2016-08-26 | The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters." |
CVE-2016-5408 | Critical | 9.8 | 2016-08-10 | Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows… |
CVE-2016-5766 | High | 8.8 | 2016-08-07 | Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6… |
CVE-2016-5392 | Medium | 6.5 | 2016-08-05 | The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of ot… |
CVE-2016-4999 | Critical | 9.8 | 2016-08-05 | SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before… |
CVE-2016-3097 | Medium | 6.1 | 2016-08-05 | Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via a group… |
CVE-2016-3080 | Medium | 6.1 | 2016-08-05 | Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script or HTML via the (1)… |
CVE-2016-5403 | Medium | 5.5 | 2016-08-02 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process… |
CVE-2016-3737 | Critical | 9.8 | 2016-08-02 | The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to mess… |
CVE-2016-5131 | High | 8.8 | 2016-07-23 | Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or po… |
CVE-2016-5444 | Low | 3.7 | 2016-07-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-5440 | Medium | 4.9 | 2016-07-21 | Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and… |
CVE-2016-3471 | High | 7.5 | 2016-07-21 | Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability v… |
CVE-2016-3452 | Low | 3.7 | 2016-07-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-2775 | Medium | 5.9 | 2016-07-19 | ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to… |
CVE-2016-5388 | High | 8.1 | 2016-07-19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applica… |
CVE-2016-5387 | High | 8.1 | 2016-07-19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in… |
CVE-2016-5386 | High | 8.1 | 2016-07-19 | The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications… |
CVE-2016-5385 | High | 8.1 | 2016-07-19 | PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untr… |
CVE-2016-5008 | Critical | 9.8 | 2016-07-13 | libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass… |
CVE-2016-5009 | Medium | 6.5 | 2016-07-12 | The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash… |
CVE-2016-4985 | High | 7.5 | 2016-07-12 | The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a… |
CVE-2016-4428 | Medium | 5.4 | 2016-07-12 | Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject… |
CVE-2016-6170 | Medium | 6.5 | 2016-07-06 | ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server… |
CVE-2016-2074 | Critical | 9.8 | 2016-07-03 | Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary… |
CVE-2016-1704 | High | 8.8 | 2016-07-03 | Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unkno… |
CVE-2016-4474 | High | 8.8 | 2016-06-30 | The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo… |
CVE-2016-2141 | Critical | 9.8 | 2016-06-30 | It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw… |
CVE-2016-5244 | High | 7.5 | 2016-06-27 | The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attacker… |
CVE-2016-4470 | Medium | 5.5 | 2016-06-27 | The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which a… |
CVE-2016-3707 | High | 8.1 | 2016-06-27 | The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327… |
CVE-2016-0758 | High | 7.8 | 2016-06-27 | Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data. |
CVE-2016-4171 | Critical | 9.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in t… |
CVE-2016-4156 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4155 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4154 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4153 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4152 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4151 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4150 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4149 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4148 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4147 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4146 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4145 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4144 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4143 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4142 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4141 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4140 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4139 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4138 | Critical | 9.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4137 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4136 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4135 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4134 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4133 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4132 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4131 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4130 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4129 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4128 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4127 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4125 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4124 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4123 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4122 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-3698 | High | 8.1 | 2016-06-13 | libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attacker… |
CVE-2016-2818 | High | 8.8 | 2016-06-13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a de… |
CVE-2016-4448 | Critical | 9.8 | 2016-06-09 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors. |
CVE-2016-2150 | High | 7.1 | 2016-06-09 | SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-… |
CVE-2016-0749 | Critical | 9.8 | 2016-06-09 | The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors… |
CVE-2016-3738 | High | 8.8 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain… |
CVE-2016-3711 | Low | 3.3 | 2016-06-08 | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[names… |
CVE-2016-3708 | High | 7.1 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespa… |
CVE-2016-3703 | Medium | 5.3 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API… |
CVE-2016-2160 | High | 8.8 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password i… |
CVE-2016-2149 | Medium | 6.5 | 2016-06-08 | Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted name… |
CVE-2016-2142 | Medium | 5.5 | 2016-06-08 | Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to o… |