Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2013-2060

OpenShift: Potential remote command execution vulnerability in download cart url

The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.

CVSS 3.1 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2013-0196

OpenShift Enterprise and Online vulnerable to CSRF attack with REST API

A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift
CVE-2013-0165

cartridge: info/bin/dump.sh /tmp file creation

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2013-0163

cartridge: predictable /tmp in set-proxy connection hook

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2012-6135

rubygem-passenger: untrusted apps Security check socket filenames reported by spawned application processes

RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Phusion Redhat
Products
Passenger Openshift
CVE-2024-49768

Waitress has request processing race condition in HTTP pipelining with invalid first request

Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Agendaless Pylons Redhat
Products
Waitress Waitress Openshift Ironic and 1 more
CVE-2024-8421

golang.org/x/net/http2: Multiple HTTP/2 enabled web servers (Rapid Reset Attack)

Red Hat Product Security has come to the conclusion that this CVE is not needed.

CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Openshift Data Foundation
CVE-2024-47068

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Rollup Rollupjs
Products
Openshift Distributed Tracing Rhdh Rollup and 1 more
CVE-2024-45410

HTTP client can remove the X-Forwarded headers in Traefik

Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Redhat Traefik
Products
Openshift Devspaces Traefik
CVE-2024-43800

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Serve-static Discovery Network Observ Optr and 8 more
CVE-2024-45590

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Expressjs Openjsf Redhat
Products
Body-parser Body-parser Advanced Cluster Security and 10 more
CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Express Discovery Network Observ Optr and 8 more
CVE-2024-8260

OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft Openpolicyagent Redhat
Products
Windows Open Policy Agent Openshift Distributed Tracing
CVE-2024-8391

Eclipse Vert.x gRPC server does not limit the maximum message size

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).  This is fixed in the 4.5.10 version.  Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Eclipse Foundation Redhat
Products
Vert.x Vert.x Camel Quarkus and 3 more
CVE-2024-39338

axios: axios: Server-Side Request Forgery

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVSS 3.1 · 4 Medium EPSS 1.2% KEV · Not listed
Vendors
Axios Redhat
Products
Axios Discovery Network Observ Optr and 5 more
CVE-2024-42353

WebOb's location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pylonsproject Redhat
Products
Webob Ceph Storage Openshift and 2 more
CVE-2016-1000023

nodejs-minimatch: Regular expression denial-of-service

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10540. Reason: This candidate is a reservation duplicate of CVE-2016-10540. Notes: All CVE users should reference CVE-2016-10540 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Openshift Rhel Software Collections
CVE-2016-1000022

nodejs-negotiator: Regular expression denial-of-service

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Openshift