Redhat : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2018-1002200	22	Dir. Trav.	2018-07-25	2018-09-18	4.3	None	Remote	Medium	Not required	None	Partial	None
plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
2	CVE-2018-1000199	388	Exec Code Mem. Corr.	2018-05-24	2018-06-27	4.9	None	Local	Low	Not required	None	None	Complete
The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.
3	CVE-2018-1000156	20	Exec Code	2018-04-06	2018-06-28	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
4	CVE-2018-14432	200	Bypass +Info	2018-07-31	2018-10-12	3.5	None	Remote	Medium	Single system	Partial	None	None
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
5	CVE-2018-14362	119	Overflow	2018-07-17	2018-09-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.
6	CVE-2018-14357	77	Exec Code	2018-07-17	2018-09-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.
7	CVE-2018-14354	77	Exec Code	2018-07-17	2018-09-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
8	CVE-2018-12533	94	Exec Code	2018-06-18	2018-10-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
9	CVE-2018-12532	94	Exec Code	2018-06-18	2018-08-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
10	CVE-2018-12020	19		2018-06-08	2018-08-01	5.0	None	Remote	Low	Not required	None	Partial	None
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
11	CVE-2018-11235	254	Exec Code Dir. Trav. Bypass	2018-05-30	2018-07-11	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
12	CVE-2018-10931	749	+Priv	2018-08-09	2018-10-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
13	CVE-2018-10915	20	Sql Bypass	2018-08-09	2018-10-09	6.0	None	Remote	Medium	Single system	Partial	Partial	Partial
A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.
14	CVE-2018-10908	399	DoS	2018-08-09	2018-10-10	7.1	None	Remote	Medium	Not required	None	None	Complete
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.
15	CVE-2018-10905	264	Exec Code	2018-07-24	2018-09-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.
16	CVE-2018-10903	20		2018-07-30	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
17	CVE-2018-10901	264		2018-07-26	2018-10-02	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.
18	CVE-2018-10898	798		2018-07-30	2018-10-10	5.8	None	Local Network	Low	Not required	Partial	Partial	Partial
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.
19	CVE-2018-10897	22	Dir. Trav.	2018-08-01	2018-10-16	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
20	CVE-2018-10894	295		2018-08-01	2018-10-15	5.5	None	Remote	Low	Single system	Partial	Partial	None
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
21	CVE-2018-10892	417		2018-07-06	2018-09-21	5.0	None	Remote	Low	Not required	None	Partial	None
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
22	CVE-2018-10885	20	DoS	2018-07-05	2018-09-02	5.0	None	Remote	Low	Not required	None	None	Partial
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster.
23	CVE-2018-10884	352	CSRF	2018-08-22	2018-10-12	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie.
24	CVE-2018-10875	426	Exec Code	2018-07-13	2018-09-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
25	CVE-2018-10874	20		2018-07-02	2018-09-04	4.6	None	Local	Low	Not required	Partial	Partial	Partial
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
26	CVE-2018-10872	119	Overflow	2018-07-10	2018-09-10	4.9	None	Local	Low	Not required	None	None	Complete
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
27	CVE-2018-10870	20	Exec Code	2018-07-19	2018-09-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
28	CVE-2018-10869	284		2018-07-19	2018-09-17	5.0	None	Remote	Low	Not required	Partial	None	None
redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.
29	CVE-2018-10864	400	DoS	2018-08-13	2018-10-10	5.0	None	Remote	Low	Not required	None	None	Partial
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.
30	CVE-2018-10862	22	Dir. Trav.	2018-07-27	2018-10-10	4.9	None	Remote	Medium	Single system	None	Partial	Partial
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
31	CVE-2018-10861	287		2018-07-10	2018-09-06	5.5	None	Remote	Low	Single system	None	Partial	Partial
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
32	CVE-2018-10855	532		2018-07-02	2018-09-04	5.0	None	Remote	Low	Not required	Partial	None	None
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
33	CVE-2018-10850	362	DoS	2018-06-13	2018-09-26	7.1	None	Remote	Medium	Not required	None	None	Complete
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
34	CVE-2018-10843	264		2018-07-02	2018-09-04	9.0	None	Remote	Low	Single system	Complete	Complete	Complete
source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
35	CVE-2018-10842	399	DoS	2018-08-13	2018-10-10	4.0	None	Remote	Low	Single system	None	None	Partial
It was found that an authenticated user could manipulate user session information to trigger an infinite loop in keycloak. A malicious user could use this flaw to conduct a denial of service attack against the server.
36	CVE-2018-10184	119	Exec Code Overflow	2018-05-09	2018-06-18	5.0	None	Remote	Low	Not required	None	None	Partial
An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.
37	CVE-2018-8897	264		2018-05-08	2018-09-28	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
38	CVE-2018-8088	502	Bypass	2018-03-20	2018-10-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.
39	CVE-2018-8039	254		2018-07-02	2018-09-12	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
40	CVE-2018-6798	119	Overflow	2018-04-17	2018-05-21	5.0	None	Remote	Low	Not required	Partial	None	None
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
41	CVE-2018-6797	119	Overflow	2018-04-17	2018-05-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.
42	CVE-2018-6764	284	Exec Code Bypass	2018-02-23	2018-03-18	4.6	None	Local	Low	Not required	Partial	Partial	Partial
util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.
43	CVE-2018-5748	399	DoS	2018-01-25	2018-06-19	5.0	None	Remote	Low	Not required	None	None	Partial
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.
44	CVE-2018-5390	20	DoS	2018-08-06	2018-10-17	7.8	None	Remote	Low	Not required	None	None	Complete
Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.
45	CVE-2018-5185	200	+Info	2018-06-11	2018-08-14	4.3	None	Remote	Medium	Not required	Partial	None	None
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
46	CVE-2018-5184	326		2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	Partial	None	None
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
47	CVE-2018-5183	119	Overflow Mem. Corr.	2018-06-11	2018-08-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.
48	CVE-2018-5178	119	Overflow	2018-06-11	2018-08-03	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 52.8, and Firefox ESR < 52.8.
49	CVE-2018-5170	20		2018-06-11	2018-08-14	4.3	None	Remote	Medium	Not required	None	Partial	None
It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
50	CVE-2018-5168	275	Bypass	2018-06-11	2018-08-03	5.0	None	Remote	Low	Not required	None	Partial	None
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

Total number of vulnerabilities : 2037 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41