Red Hat CVEs
2,579 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-1708It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple conta
- CVE-2013-2060The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL
- CVE-2012-5626EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Por
- CVE-2019-14888A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS.
- CVE-2019-14885A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA.
- CVE-2019-3864A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific paramete
- CVE-2019-19344There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x ver
- CVE-2019-14907All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3"
- CVE-2019-19339It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207.
- CVE-2010-3282389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is e
- CVE-2019-14906A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability.
- CVE-2019-14819A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster.
- CVE-2019-14866In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
- CVE-2019-14854OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Deb
- CVE-2019-14843A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester.
- CVE-2019-14837A flaw was found in keycloack before version 8.0.0.
- CVE-2014-6275FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default.
- CVE-2014-0245It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe.
- CVE-2014-0169In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain.
- CVE-2019-10205A flaw was found in the way Red Hat Quay stores robot account tokens in plain text.
- CVE-2019-10158A flaw was found in Infinispan through version 9.4.14.Final.
- CVE-2019-14864Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it
- CVE-2019-14863There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli
- CVE-2019-14862There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application
- CVE-2019-14859A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding.
- CVE-2019-19337A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests.
- CVE-2019-19342A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contain
- CVE-2019-19340A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-
- CVE-2019-14899A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user
- CVE-2019-14861All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC