Red Hat CVEs
2,580 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-15108spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces
- CVE-2017-12197It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating.
- CVE-2017-12189It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handlin
- CVE-2017-7559In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 w
- CVE-2017-7536In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whi
- CVE-2017-15131It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh befor
- CVE-2017-15121A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that d
- CVE-2017-7501It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM.
- CVE-2017-12172PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs
- CVE-2017-15099INSERT ...
- CVE-2017-15098Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before
- CVE-2017-7550A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module.
- CVE-2017-15087It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHE
- CVE-2017-15086It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHE
- CVE-2017-15085It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHE
- CVE-2017-15096A flaw was found in GlusterFS in versions prior to 3.10.
- CVE-2017-12160It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serve
- CVE-2017-12159It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.
- CVE-2017-12158It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.
- CVE-2017-12149In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOn
- CVE-2017-7549A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform
- CVE-2017-7544libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c c
- CVE-2017-12170Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was
- CVE-2017-7561Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS com
- CVE-2017-7560It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes.
- CVE-2017-7557dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.
- CVE-2017-7556Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their we
- CVE-2017-7555Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings.
- CVE-2017-7540rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax.
- CVE-2017-7523Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting int