Red Hat CVEs
2,577 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-6505Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss
- CVE-2024-6126Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option
- CVE-2024-4467Qemu-kvm: 'qemu-img info' leads to host file read/write
- CVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dos
- CVE-2024-6239Poppler: pdfinfo: crash in broken documents when using -dests parameter
- CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listener
- CVE-2024-5967Keycloak: leak of configured ldap bind credentials through the keycloak admin console
- CVE-2024-5953389-ds-base: malformed userpassword hash may cause denial of service
- CVE-2024-5891Quay: unauthorized user may authenticate via oauth application token
- CVE-2024-5742Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a…
- CVE-2024-5154Cri-o: malicious container can create symlink on host
- CVE-2024-3183Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force
- CVE-2024-2698Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service
- CVE-2023-4727Ca: token authentication bypass vulnerability
- CVE-2024-3049Booth: specially crafted hash can lead to invalid hmac being accepted by booth server
- CVE-2024-5037Openshift/telemeter: iss check during jwt authentication can be bypassed
- CVE-2024-4812Katello: potential cross-site scripting exploit in ui
- CVE-2024-3716Foreman-installer: candlepin database password being leaked to local users via the process list
- CVE-2024-4540Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
- CVE-2024-5564Libndp: buffer overflow in route information length field
- CVE-2024-3657389-ds-base: potential denial of service via specially crafted kerberos as-req request
- CVE-2024-2199389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c
- CVE-2024-5042Submariner-operator: rbac permissions can allow for the spread of node compromises
- CVE-2024-4871Foreman: host ssh key not being checked in remote execution
- CVE-2024-4840Rhosp-director: cleartext passwords exposed in logs
- CVE-2024-4693Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
- CVE-2024-3727Containers/image: digest type does not guarantee valid type
- CVE-2024-4438Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform
- CVE-2024-4437Etcd: incomplete fix for cve-2021-44716 in openstack platform
- CVE-2024-4436Etcd: incomplete fix for cve-2022-41723 in openstack platform