Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2014-0245

WSRP: Information disclosure via unsafe concurrency handling in interceptor

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For a specific WSRP endpoint, under high-concurrency scenarios or scenarios where SOAP messages take long to execute, it was possible for an unauthenticated remote attacker to gain privileged information if WS-Security is enabled for the WSRP Consumer, and the endpoint in question is being used by a privileged user. This affects JBoss Portal 6.2.0.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Portal Platform Jboss Portal
CVE-2014-0242

mod_wsgi: information leak

mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Modwsgi Redhat
Products
Mod Wsgi Enterprise Linux
CVE-2014-0241

rubygem-hammer_cli_foreman: /etc/hammer/cli.modules.d/foreman.yml is world-readable

rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Hammer Cli
CVE-2014-0234

openshift-origin-broker: default password creation

The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.

CVSS 3.1 · 9.8 Critical EPSS 3.8% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2014-0183

XSS: HTML in systems name (when registering) gets interpreted on system information page

Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Subscription Asset Manager
CVE-2014-0169

EAP: cache is shared between all applications in a security domain

In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an intended functionality, it was not clearly documented which can mislead users into thinking that a security domain cache is isolated to a single application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2014-0163

Openshift: Multiple shell command injection flaws

Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2014-0148

Qemu: vhdx: bounds checking for block_size and logical_sector_size

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2014-0147

Qemu: block: possible crash due signed types or logic error

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Fedora Qemu Enterprise Linux and 9 more
CVE-2014-0144

Qemu: block: missing input validation

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.

CVSS 3.1 · 8.6 High EPSS 1.0% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2014-0087

CFME: check_privileges logic error resulting in privilege escalation

The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Cloudforms Management Engine Cloudforms Managementengine
CVE-2014-0084

rubygem-openshift-origin-node: cron.daily/cron.weekly denial of service

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2014-0068

node-util: world writable files

It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift-origin-node-util
CVE-2014-0023

OpenShift: install script has temporary file creation vulnerability

OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2013-7488

perl-Convert-ASN1: allows remote attackers to cause an infinite loop via unexpected input

perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Convert\ Fedoraproject Redhat
Products
\ Fedora Enterprise Linux