Red Hat CVEs
2,577 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-49394Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing
- CVE-2024-49393Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing
- CVE-2024-11079Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
- CVE-2024-10963Pam: improper hostname interpretation in pam_access leads to access control bypass
- CVE-2023-1973Undertow: unrestricted request storage leads to memory exhaustion
- CVE-2023-1932Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss
- CVE-2024-6861Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api
- CVE-2024-9902Ansible-core: ansible-core user may read/write unauthorized content
- CVE-2024-10573Mpg123: buffer overflow when writing decoded pcm samples
- CVE-2024-8553Foreman: read-only access to entire db from templates
- CVE-2024-9632Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
- CVE-2024-10295Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to…
- CVE-2024-10041Pam: libpam: libpam vulnerable to read hashed password
- CVE-2024-50312Graphql: information disclosure via graphql introspection in openshift
- CVE-2024-50311Graphql: denial of service (dos) vulnerability via graphql batching
- CVE-2024-10234Wildfly: wildfly vulnerable to cross-site scripting (xss)
- CVE-2024-9050Networkmanager-libreswan: local privilege escalation via leftupdown
- CVE-2024-6519Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability
- CVE-2024-9683Quay: quay allows successful authentication with trucated version of the password
- CVE-2024-10033Aap-gateway: xss on aap-gateway
- CVE-2024-9676Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)
- CVE-2024-9979Pyo3: risk of use-after-free in `borrowed` reads from python weak references
- CVE-2024-3656Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities
- CVE-2024-9675Buildah: buildah allows arbitrary directory mount
- CVE-2024-9671System: pdf invoices of the developer users can be seen if the url is known
- CVE-2024-9622Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4
- CVE-2024-9621Io.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application log
- CVE-2024-9620Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption
- CVE-2024-9407Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
- CVE-2024-9341Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library