Red Hat CVEs
2,579 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-2008Kernel: udmabuf: improper validation of array index leading to local privilege escalation
- CVE-2023-1989Kernel: use after free bug in btsdio_remove due to race condition
- CVE-2022-3205Controller: cross site scripting in automation controller ui
- CVE-2021-4037Kernel: security regression for cve-2018-13405
- CVE-2020-27792Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c
- CVE-2020-14341The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connec
- CVE-2020-14366A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources
- CVE-2020-25655An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions.
- CVE-2020-25661A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A
- CVE-2020-25662A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initializa
- CVE-2020-25689A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating n
- CVE-2020-25633A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final.
- CVE-2020-14332A flaw was found in the Ansible Engine when using module_args.
- CVE-2020-14330An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content a
- CVE-2020-14297A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accum
- CVE-2020-14307A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations a
- CVE-2020-10727A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plain
- CVE-2020-10753A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway).
- CVE-2020-10782An exposure of sensitive information flaw was found in Ansible version 3.7.0.
- CVE-2020-10755An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions
- CVE-2020-10761An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1.
- CVE-2020-10754It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when c
- CVE-2020-10749A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernete
- CVE-2020-10737A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the ho
- CVE-2020-10719A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes.
- CVE-2020-10711A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
- CVE-2020-1695A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an imprope
- CVE-2020-1758A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using t
- CVE-2020-10744An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become
- CVE-2020-1714A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.