Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 168

Export CSV
CVE-2020-8565

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift Container Storage Openshift Data Foundation
CVE-2020-16251

vault: GCP Auth Method Allows Authentication Bypass

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

CVSS 3.1 · 8.2 High EPSS 2.8% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Vault Openshift Openshift Data Foundation
CVE-2020-16250

vault: Hashicorp Vault AWS IAM Integration Authentication Bypass

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

CVSS 3.1 · 8.2 High EPSS 1.5% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Vault Openshift Openshift Data Foundation
CVE-2024-8421

golang.org/x/net/http2: Multiple HTTP/2 enabled web servers (Rapid Reset Attack)

Red Hat Product Security has come to the conclusion that this CVE is not needed.

CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Openshift Data Foundation
CVE-2024-43800

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Serve-static Discovery Network Observ Optr and 8 more
CVE-2024-45590

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Expressjs Openjsf Redhat
Products
Body-parser Body-parser Advanced Cluster Security and 10 more
CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Express Discovery Network Observ Optr and 8 more