Red Hat CVEs
2,580 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-3876A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to
- CVE-2019-3869When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variabl
- CVE-2018-10934A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA.
- CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files out
- CVE-2019-3813Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt.
- CVE-2018-16876ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to le
- CVE-2018-16859Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' pa
- CVE-2018-14658A flaw was found in JBOSS Keycloak 3.2.1.Final.
- CVE-2018-14657A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final.
- CVE-2018-14655A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.
- CVE-2018-14642An information leak vulnerability was found in Undertow.
- CVE-2018-10937A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11.
- CVE-2018-1127Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out.
- CVE-2018-1114It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file de
- CVE-2018-10935A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
- CVE-2018-10893Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames.
- CVE-2016-7066It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow an
- CVE-2016-7070A privilege escalation flaw was found in the Ansible Tower.
- CVE-2016-7047A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2.
- CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.
- CVE-2018-14620The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage.
- CVE-2016-7061An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4.
- CVE-2016-7041Drools Workbench contains a path traversal vulnerability.
- CVE-2016-7071It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users.
- CVE-2016-7075It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fi
- CVE-2018-14632An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before
- CVE-2018-10930A flaw was found in RPC request using gfs3_rename_req in glusterfs server.
- CVE-2018-10929A flaw was found in RPC request using gfs2_create_req in glusterfs server.
- CVE-2018-10928A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside
- CVE-2018-10927A flaw was found in RPC request using gfs3_lookup_req in glusterfs server.