Red Hat CVEs
2,580 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-2674JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central.
- CVE-2017-2658It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Se
- CVE-2017-2653A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST reques
- CVE-2017-2646It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestPar
- CVE-2017-2621An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory w
- CVE-2017-2614When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if
- CVE-2017-2590A vulnerability was found in ipa before 4.4.
- CVE-2017-15113ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking.
- CVE-2017-12148A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories.
- CVE-2017-15125A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HT
- CVE-2017-12195A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin.
- CVE-2017-12165It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause poss
- CVE-2017-2582It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining a
- CVE-2017-12175Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.
- CVE-2017-12171A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configurat
- CVE-2017-12167It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user t
- CVE-2017-7509An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1.
- CVE-2017-7538A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8.
- CVE-2017-2589It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies ar
- CVE-2017-7543A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10
- CVE-2017-2664CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application port
- CVE-2016-8647An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in
- CVE-2017-7530In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbit
- CVE-2018-1129A flaw was found in the way signature calculation was handled by cephx authentication protocol.
- CVE-2018-1128It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack.
- CVE-2018-10861A flaw was found in the way ceph mon handles user requests.
- CVE-2018-10841glusterfs is vulnerable to privilege escalation on gluster server nodes.
- CVE-2018-1111DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager i
- CVE-2018-1131Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.
- CVE-2018-1104Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute