Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2019-14900

hibernate: SQL injection issue in Hibernate ORM

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Hibernate Quarkus Redhat
Products
Hibernate Orm Quarkus Build Of Quarkus and 14 more
CVE-2019-14891

cri-o: infra container reparented to systemd following OOM Killer killing it's conmon

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Kubernetes Redhat
Products
Fedora Cri-o Openshift and 1 more
CVE-2019-14888

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Jboss Data Grid Jboss Enterprise Application Platform and 7 more
CVE-2019-14887

wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.

CVSS 3.1 · 9.1 Critical EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 5 more
CVE-2019-14854

library-go: Secret data written to static pod logs when operator set at Debug level or higher

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2019-14845

openshift: Container image TLS verification bypass

A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this flaw by launching a man-in-the-middle attack and injecting malicious content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2019-14838

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Data Grid Enterprise Linux Jboss Data Grid and 7 more
CVE-2019-14835

kernel: vhost-net: guest to host kernel escape during migration

A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 46 more
CVE-2019-14832

keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more
CVE-2019-14822

ibus: missing authorization allows local attacker to access the input bus of another user

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Ibus Project Oracle and 1 more
Products
Ubuntu Linux Ibus Zfs Storage Appliance Kit and 2 more
CVE-2019-14820

keycloak: adapter endpoints are exposed via arbitrary URLs

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Fuse Jboss Single Sign On and 4 more
CVE-2019-14819

openshift-ansible: dockergc service account incorrectly associated with namespace during upgrade

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2019-14817

ghostscript: Safer mode bypass by .forceput exposure in .pdfexectoken and other procedures (701450)

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 4 more
CVE-2019-14813

ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 10 more
CVE-2019-14811

ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 3.7% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 4 more
CVE-2019-14287

sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-13734

sqlite: fts3: improve shadow table corruption detection

Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 17 more
CVE-2019-12450

glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

CVSS 3.1 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 7 more
CVE-2019-12423

cxf: OpenId Connect token service does not properly validate the clientId

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.

CVSS 3.1 · 7.5 High EPSS 6.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Commerce Guided Search Communications Diameter Signaling Router and 11 more
CVE-2019-12419

cxf: OpenId Connect token service does not properly validate the clientId

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

CVSS 3.1 · 9.8 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Commerce Guided Search Enterprise Manager Base Platform and 5 more