Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2018-3830

kibana: Cross-site scripting via the source field formatter

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Elastic Redhat
Products
Kibana Openshift Openshift Container Platform
CVE-2018-20615

haproxy: Mishandling of priority flag in short HEADERS frame by HTTP/2 decoder allows for crash

An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing of the PRIORITY flag in a HEADERS frame requires 5 extra bytes, and while these bytes are skipped, the total frame length was not re-checked to make sure they were present in the frame.

CVSS 3.0 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Canonical Haproxy Opensuse and 1 more
Products
Ubuntu Linux Haproxy Leap and 4 more
CVE-2018-20103

haproxy: Infinite recursion via crafted packet allows stack exhaustion and denial of service

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

CVSS 3.0 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Canonical Haproxy Redhat
Products
Ubuntu Linux Haproxy Openshift and 2 more
CVE-2018-20102

haproxy: Out-of-bounds read in dns.c:dns_validate_dns_response() allows for memory disclosure

An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, remote attackers might be able read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of accepted_payload_size.

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Canonical Haproxy Redhat
Products
Ubuntu Linux Haproxy Openshift and 2 more
CVE-2018-1336

tomcat: A bug in the UTF-8 decoder can lead to DoS

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

CVSS 3.1 · 7.5 High EPSS 20.4% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 9 more
CVE-2018-1275

spring-framework: Address partial fix for CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

CVSS 3.1 · 9.8 Critical EPSS 57.7% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Application Testing Suite Big Data Discovery Communications Converged Application Server and 18 more
CVE-2018-1272

spring-framework: Multipart content pollution

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Application Testing Suite Big Data Discovery Communications Converged Application Server and 24 more
CVE-2018-1271

spring-framework: Directory traversal vulnerability with static resources on Windows filesystems

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

CVSS 3.1 · 5.9 Medium EPSS 30.3% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Application Testing Suite Big Data Discovery Communications Converged Application Server and 27 more
CVE-2018-1260

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Security Oauth Jboss Fuse Openshift Application Runtimes
CVE-2018-1114

undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2018-1102

source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

CVSS 3.0 · 8.8 High EPSS 2.4% KEV · Not listed
Vendors
Redhat
Products
Openshift Rhel Software Collections
CVE-2018-1085

openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster.

CVSS 3.0 · 9 Critical EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2018-1070

Routing: Malicous Service configuration can bring down routing for an entire shard.

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2018-1069

Networking: container networking does not prevent access to network resources

Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2018-1067

undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 3 more
CVE-2018-1059

dpdk: Information exposure in unchecked guest physical to host virtual address translations

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Dpdk Redhat
Products
Ubuntu Linux Data Plane Development Kit Ceph Storage and 8 more
CVE-2018-1047

undertow: Path traversal in ServletResourceManager class

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Server Jboss Enterprise Application Platform Jboss Wildfly Application Server and 1 more
CVE-2018-19475

ghostscript: access bypass in psi/zdevice2.c (700153)

psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.

CVSS 3.0 · 7.8 High EPSS 9.5% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 8 more