Red Hat CVEs
2,580 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-7480rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remot
- CVE-2017-7496fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of
- CVE-2017-7515poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.
- CVE-2017-7504HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Appli
- CVE-2017-7475Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an applicatio
- CVE-2017-7503It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE.
- CVE-2017-7474It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.
- CVE-2012-0059Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages
- CVE-2011-3344Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form
- CVE-2011-2927Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms
- CVE-2011-2920Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.
- CVE-2011-1594Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter
- CVE-2012-3427Jboss-eap: aws-ec2: jboss eap and aws ec2: information disclosure via incorrect directory permissions
- CVE-2013-2056Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass
- CVE-2013-0270Keystone: openstack keystone: denial of service via large http request with long tenant name
- CVE-2013-1815Packstack: red hat openstack: packstack: unauthorized system modification via insecure answer file creation
- CVE-2013-1840Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request
- CVE-2013-0335Openstack nova: vnc proxy can connect to the wrong vm
- CVE-2013-0266Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to…
- CVE-2013-0261Packstack: packstack: arbitrary file overwrite via symlink attack
- CVE-2012-4550Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass
- CVE-2012-4549Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization
- CVE-2012-5605Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions
- CVE-2012-4574Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file
- CVE-2012-5625Openstack nova: information leak in libvirt lvm-backed instances
- CVE-2012-5571Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
- CVE-2011-4346Satellite: xss in custom system information key handling
- CVE-2009-4139Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery
- CVE-2010-3872Httpd: mod_fcgid: stack-based buffer overflow in fcgid_header_bucket_read() in modules/fcgid/fcgid_bucket.c
- CVE-2006-4339Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass