Vendor
Red Hat
2,622 known vulnerabilities.
Products
1,392 results · Clear filters · Feed
-
Medium 5.1
An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specif…
-
Medium 5.3
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enab…
-
Medium 6.4
A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. A…
-
Medium 5.6
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector do…
-
Medium 5.3
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…
-
Medium 6.5
In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ball…
-
Medium 6.5
In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ba…
-
Medium 6.5
In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc …
-
Medium 6.5
In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc …
-
Medium 6.5
In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ballo…
-
Medium 6.5
In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc …
-
Medium 5.4
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3…
-
Medium 6.5
The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without c…
-
Medium 4.4
During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, w…
-
Medium 6.5
The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP…
-
Medium 4.7
A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …
-
Medium 4.2
Path Traversal in Ansible
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be …
-
Medium 5.0
Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as pass…
-
Medium 5.0
Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp.…
-
Medium 5.9
Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
-
Medium 4.6
A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are st…
-
Medium 6.1
XSS in Keycloak
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other r…
-
Medium 5.4
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system …
-
Medium 5.4
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests includ…
-
Medium 6.5
There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and…
-
Medium 6.5
All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set…
-
Medium 6.5
It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A f…
-
Medium 6.7
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is u…
-
Medium 5.3
OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given o…
-
Medium 6.0
A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform databas…
-
Medium 5.4
Improper implementation of the session fixation protection in Infinispan
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
-
Medium 5.7
Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would disclos…
-
Medium 6.1
XSS in knockout
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
-
Medium 6.5
A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An aut…
-
Medium 5.9
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-reada…
-
Medium 5.3
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and…
-
Medium 5.3
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly…
-
Medium 5.4
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS…
-
Medium 6.6
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…
-
Medium 5.7
FreeIPA logs passwords embedded in commands in calls using batch
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA mast…