Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2015-7501

apache-commons-collections: InvokerTransformer code execution during deserialisation

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

CVSS 3.0 · 9.8 Critical EPSS 85.6% KEV · Not listed
Vendors
Redhat
Products
Data Grid Enterprise Linux Jboss A-mq and 19 more
CVE-2022-23524

Helm vulnerable to Denial of service through string value parsing

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Helm Redhat
Products
Helm Openshift
CVE-2022-23525

Helm vulnerable to Denial of service via NULL Pointer Dereference

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Helm Redhat
Products
Helm Openshift
CVE-2022-23526

Helm contains Denial of service through schema file

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The _chartutil_ package parses the schema file and loads it into structures Go can work with. Some schema files can cause array data structures to be created causing a memory violation. Applications that use the _chartutil_ package in the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate schema files that are correctly formatted before passing them to the _chartutil_ functions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Helm Redhat
Products
Helm Openshift
CVE-2025-21613

go-git has an Argument Injection via the URL field

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.

CVSS 4.0 · 9.2 Critical EPSS 1.3% KEV · Not listed
Vendors
Go-git Project Redhat
Products
Go-git Advanced Cluster Security Enterprise Linux and 6 more
CVE-2022-23539

jsonwebtoken unrestricted key type could lead to legacy keys usage

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Auth0 Redhat
Products
Jsonwebtoken Openshift Data Foundation
CVE-2021-38561

golang: out-of-bounds read in golang.org/x/text/language leads to DoS

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Golang Redhat
Products
Text Acm Container Native Virtualization and 3 more
CVE-2015-5305

Kubernetes: Missing name validation allows path traversal in etcd

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

CVSS 2.0 · 6.4 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2015-5274

2.2: API command injection vulnerability

rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.

CVSS 2.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2015-5254

ObjectMessage: unsafe deserialization

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

CVSS 3.0 · 9.8 Critical EPSS 38.2% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Activemq Fedora Jboss Amq and 2 more
CVE-2015-5250

OpenShift: Malformed JSON can cause API process crash

The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2015-5222

OpenShift3: Exec operations should be forbidden to privileged pods such as builder pods

Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.

CVSS 2.0 · 8.5 High EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2015-3281

haproxy: information leak in buffer_slow_realign()

The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Haproxy and 3 more
Products
Ubuntu Linux Debian Linux Haproxy and 11 more
CVE-2015-1814

jenkins: forced API token change (SECURITY-180)

The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2015-1813

jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2015-1812

jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2015-1810

jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)

The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.

CVSS 2.0 · 4.6 Medium EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2015-1808

jenkins: update center metadata retrieval DoS attack (SECURITY-163)

Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.

CVSS 2.0 · 3.5 Low EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift