Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2018-10894

keycloak: auth permitted with expired certs in SAML client

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Single Sign On Keycloak and 3 more
CVE-2018-10885

atomic-openshift: Malicious network-policy can cause Openshift Routing DoS when using ovs-networkpolicy plugin

In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2018-10875

ansible: ansible.cfg is being read from current working directory allowing possible code execution

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Ansible Engine and 9 more
CVE-2018-10862

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Data Grid Jboss Enterprise Application Platform and 5 more
CVE-2018-10843

source-to-image: Builder images with assembler-user LABEL set to root allows attackers to execute arbitrary code

source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.

CVSS 3.0 · 8.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2018-10237

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Guava Banking Payments Communications Ip Service Activator and 18 more
CVE-2018-10184

haproxy: Heap buffer overflow in mux_h2.c:h2_process_demux() can allow attackers to cause a denial of service

An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.

CVSS 3.0 · 7.5 High EPSS 8.1% KEV · Not listed
Vendors
Haproxy Redhat
Products
Haproxy Enterprise Linux Openshift and 1 more
CVE-2018-1002105

kubernetes: authentication/authorization bypass in the handling of non-101 responses

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

CVSS 3.0 · 9.8 Critical EPSS 87.0% KEV · Not listed
Vendors
Kubernetes Netapp Redhat
Products
Kubernetes Trident Openshift and 1 more
CVE-2018-1002102

Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Kubernetes Redhat
Products
Fedora Kubernetes Openshift
CVE-2018-1002100

kubernetes: Kubectl copy doesn't check for paths outside of it's destination directory

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

CVSS 3.0 · 4.2 Medium EPSS 1.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2018-1000997

jenkins: Path traversal vulnerability in Stapler allowed accessing internal data

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2018-1000866

jenkins-plugin-script-security: Sandbox Bypass in finalize methods

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Pipeline\ Openshift Openshift Container Platform
CVE-2018-1000865

jenkins-plugin-script-security: Sandbox Bypass in finalize methods

A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift Openshift Container Platform
CVE-2018-1000864

jenkins: potential denial of service through cron expression form validation (SECURITY-1193)

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift Openshift Container Platform
CVE-2018-1000863

jenkins: forced migration of user records (SECURITY-1072)

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.

CVSS 3.0 · 8.2 High EPSS 6.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift Openshift Container Platform
CVE-2018-1000862

jenkins: workspace browser allowed accessing files outside the workspace (SECURITY-904)

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.

CVSS 3.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift Openshift Container Platform
CVE-2018-1000410

jenkins: Failures to process form submission data could result in secrets being displayed or written to logs

An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2018-1000409

jenkins: Session fixation vulnerability on user signup

A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a user signed up for a new user account.

CVSS 3.0 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2018-1000408

jenkins: Ephemeral user record creation

A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2018-1000407

jenkins: Reflected XSS vulnerability

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.

CVSS 3.0 · 6.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift