Vendor
Red Hat
2,622 known vulnerabilities.
Products
1,392 results · Clear filters · Feed
-
Medium 5.7
Exposure of Sensitive Information to an Unauthorized Actor in ansible
A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setti…
-
Medium 5.3
OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log leve…
-
Medium 4.7CVE-2019-10207 Public exploit
A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…
-
Medium 4.3
A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and d…
-
Medium 4.1
Katello cleartext password storage issue
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials …
-
Medium 4.3
PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a seri…
-
Medium 6.5
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in Clo…
-
Medium 6.4
Ansible password prompts could expose passwords
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent…
-
Medium 5.9
Improper Restriction of XML External Entity Reference in jackson-mapper-asl
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
-
Medium 5.3
kube-state-metrics may expose secret content in metrics
A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata ab…
-
Medium 5.9
An oversight while backporting a feature leads to an assertion failure in buffer.c:420
While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 -> bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distribu…
-
Medium 5.2
Wildfly Authorization Misconfiguration
A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
-
Medium 6.1
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. A…
-
Medium 5.7
A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container imag…
-
Medium 5.6
It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows att…
-
Medium 4.8
Potential to access user credentials from the log files when debug logging enabled
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
-
Medium 5.6
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attac…
-
Medium 4.6
Improper Input Validation and Cross-Site Request Forgery in Keycloak
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
-
Medium 4.2
A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster…
-
Medium 4.6
Exposure of Sensitive Information to an Unauthorized Actor in ansible
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…
-
Medium 5.9
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficientl…
-
Medium 4.6
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3…
-
Medium 6.5
A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and…
-
Medium 4.3
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorizat…
-
Medium 6.5
Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately co…
-
Medium 4.7
Forced Logout in keycloak-connect
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF paramet…
-
Medium 5.4
It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Applicat…
-
Medium 5.3
Credential exposure through log files in Undertow
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER…
-
Medium 6.4
It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude paramet…
-
Medium 5.9
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using…
-
Medium 5.3
A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restric…
-
Medium 5.5
Openstack Octavia Access Control Vulnerability
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a …
-
Medium 5.4
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a Secur…
-
Medium 5.5
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.…
-
Medium 6.3
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while han…
-
Medium 5.3
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worke…
-
Medium 5.5
It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the c…
-
Medium 5.0
A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation …
-
Medium 5.4
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.G…
-
Medium 4.2
Ansible Path Traversal vulnerability
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.