Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2016-3711

haproxy: Setting cookie containing internal IP address of a pod

HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2014-3496

Origin: Command execution as root via downloadable cartridge source-url

cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2015-5250

OpenShift: Malformed JSON can cause API process crash

The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2016-2160

Privilege escalation when changing root password in sti builder image

Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image.

CVSS 3.0 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2012-5646

openshift-origin-node-util: restorer.php preg_match shell code injection

node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2012-5647

openshift-origin-node-util: restorer.php arbitrary URL redirection

Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.

CVSS 2.0 · 5.8 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2012-5658

Origin: rhc-chk.rb password exposure in log files

rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla reports in support channels.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2013-0164

openshift-origin-port-proxy: openshift-port-proxy-cfg lockwrap() tmp file creation

The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2014-3592

Origin: XSS in team name

OpenShift Origin: Improperly validated team names could allow stored XSS attacks

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Origin
CVE-2014-0084

rubygem-openshift-origin-node: cron.daily/cron.weekly denial of service

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin