Red Hat CVEs
2,580 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2018-1101Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalati
- CVE-2018-1102A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x.
- CVE-2018-1059The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing
- CVE-2018-1106An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signe
- CVE-2018-1088A privilege escalation flaw was found in gluster 3.x snapshot scheduler.
- CVE-2017-7534OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods.
- CVE-2018-1082A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4.
- CVE-2018-1081A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions.
- CVE-2018-1099DNS rebinding vulnerability found in etcd 3.3.1 and earlier.
- CVE-2018-1098A cross-site request forgery flaw was found in etcd 3.3.1 and earlier.
- CVE-2017-2628curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did
- CVE-2017-2585Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant
- CVE-2016-9589Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service.
- CVE-2016-8629Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the r
- CVE-2016-9606JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untr
- CVE-2016-8612Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in th
- CVE-2016-9585Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passe
- CVE-2018-1069Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems.
- CVE-2017-12174It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created
- CVE-2018-1054An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4
- CVE-2017-15134A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled
- CVE-2017-12191A flaw was found in the CloudForms account configuration when using VMware.
- CVE-2017-15136When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previou
- CVE-2017-12161It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset reque
- CVE-2018-1049In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serv
- CVE-2018-1041A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer.
- CVE-2018-1051It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible
- CVE-2018-1048It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allo
- CVE-2018-1047A flaw was found in Wildfly 9.x.
- CVE-2017-15135It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly