[ Vendor · 51 CVEs ]
Redhat
CVEs affecting Redhat published in the last 30 days, plus any Redhat CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2019-13272 | 17 Jul 2019 | CVSS 7.8 | Linux Kernel Improper Privilege ManagementIn the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a… | ExploitedFix |
| CVE-2018-15982 | 18 Jan 2019 | CVSS 7.8 | Adobe Flash Player Use-After-FreeFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to… | ExploitedFix |
| CVE-2018-1000861 | 10 Dec 2018 | CVSS 9.8 | Jenkins Stapler Web Framework Deserialization of Untrusted DataA code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in… | Exploited |
| CVE-2017-1000253 | 5 Oct 2017 | CVSS 7.8 | Linux Kernel PIE Stack Buffer CorruptionLinux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86… | ExploitedFix |
| CVE-2017-8291 | 27 Apr 2017 | CVSS 7.8 | Artifex Ghostscript Type ConfusionArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%"… | ExploitedFix |
| CVE-2016-5195 | 10 Nov 2016 | CVSS 7.0 | Linux Kernel Race ConditionRace condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of… | ExploitedFix |
| CVE-2016-7855 | 1 Nov 2016 | CVSS 8.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to… | ExploitedFix |
| CVE-2016-4171 | 16 Jun 2016 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as… | Exploited |
| CVE-2016-4437 | 7 Jun 2016 | CVSS 9.8 | Apache Shiro Code ExecutionApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code… | Exploited |
| CVE-2016-4117 | 11 May 2016 | CVSS 9.8 | Adobe Flash Player Arbitrary Code ExecutionAdobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May… | Exploited |
| CVE-2016-3718 | 5 May 2016 | CVSS 5.5 | ImageMagick Server-Side Request Forgery (SSRF)The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery… | ExploitedFix |
| CVE-2016-3715 | 5 May 2016 | CVSS 5.5 | ImageMagick Arbitrary File DeletionThe EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. | ExploitedFix |
| CVE-2016-1646 | 29 Mar 2016 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds ReadThe Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider… | ExploitedFix |
| CVE-2016-0752 | 16 Feb 2016 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x… | Exploited |
| CVE-2015-8651 | 28 Dec 2015 | CVSS 8.8 | Adobe Flash Player Integer OverflowInteger overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux… | ExploitedFix |
| CVE-2015-5287 | 7 Dec 2015 | CVSS 7.8 | Red Hat Automatic Bug Reporting Tool Privilege EscalationThe abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges… | ExploitedFix |
| CVE-2015-5317 | 25 Nov 2015 | CVSS 7.5 | Jenkins User Interface (UI) Information DisclosureThe Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information… | Exploited |
| CVE-2015-4902 | 22 Oct 2015 | CVSS 5.3 | Oracle Java SE Integrity CheckUnspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to… | ExploitedFix |
| CVE-2015-7645 | 15 Oct 2015 | CVSS 7.8 | Adobe Flash Player Arbitrary Code ExecutionAdobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote… | ExploitedFix |
| CVE-2015-3246 | 11 Aug 2015 | CVSS 7.4 | Red Hat Libuser Race Conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which… | Exploited |
| CVE-2015-4495 | 8 Aug 2015 | CVSS 8.8 | Mozilla Firefox Security Feature BypassThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | ExploitedFix |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-2590 | 16 Jul 2015 | CVSS 9.8 | Oracle Java SE and Java SE Embedded Remote Code ExecutionUnspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect… | ExploitedFix |
| CVE-2015-5123 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5122 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5119 | 8 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x… | ExploitedFix |
| CVE-2015-3113 | 23 Jun 2015 | CVSS 9.8 | Adobe Flash Player Heap-Based Buffer OverflowHeap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-3043 | 14 Apr 2015 | CVSS 9.8 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to… | ExploitedFix |
| CVE-2015-1427 | 17 Feb 2015 | CVSS 9.8 | Elasticsearch Groovy Scripting Engine Remote Code ExecutionThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism… | ExploitedFix |
| CVE-2014-7169 | 25 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which… | ExploitedFix |
| CVE-2014-6271 | 24 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2014-3153 | 7 Jun 2014 | CVSS 7.8 | Linux Kernel Privilege EscalationThe futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which… | ExploitedFix |
| CVE-2014-0130 | 7 May 2014 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18… | Exploited |
| CVE-2014-0196 | 7 May 2014 | CVSS 5.5 | Linux Kernel Race ConditionThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST"… | ExploitedFix |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |
| CVE-2013-1690 | 26 Jun 2013 | CVSS 8.8 | Mozilla Firefox and Thunderbird Denial-of-ServiceMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Exploited |
| CVE-2013-2729 | 16 May 2013 | CVSS 9.8 | Adobe Reader and Acrobat Arbitrary Integer OverflowInteger overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code… | ExploitedFix |
| CVE-2013-1675 | 16 May 2013 | CVSS 6.5 | Mozilla Firefox Information DisclosureMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly… | Exploited |
| CVE-2013-0648 | 27 Feb 2013 | CVSS 8.8 | Adobe Flash Player Code ExecutionUnspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171… | ExploitedFix |
| CVE-2013-0640 | 14 Feb 2013 | CVSS 7.8 | Adobe Reader and Acrobat Memory CorruptionAdobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a… | Exploited |
| CVE-2013-0641 | 14 Feb 2013 | CVSS 7.8 | Adobe Reader Buffer OverflowBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute… | Exploited |
| CVE-2012-4681 | 28 Aug 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionMultiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute… | Exploited |
| CVE-2012-1535 | 15 Aug 2012 | CVSS 7.8 | Adobe Flash Player Arbitrary Code ExecutionUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers… | ExploitedFix |
| CVE-2012-1723 | 16 Jun 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update… | Exploited |
| CVE-2012-2034 | 9 Jun 2012 | CVSS 7.5 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux… | Exploited |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |
| CVE-2011-3544 | 19 Oct 2011 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote… | ExploitedFix |
| CVE-2010-3904 | 6 Dec 2010 | CVSS 7.8 | Linux Kernel Improper Input ValidationThe rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36… | ExploitedFix |
| CVE-2010-1871 | 5 Aug 2010 | CVSS 8.8 | Red Hat Linux JBoss Seam 2 Remote Code ExecutionJBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss… | Exploited |
| CVE-2010-0738 | 28 Apr 2010 | CVSS 5.3 | Red Hat JBoss Authentication BypassThe JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3… | Exploited |
| CVE-2010-1428 | 28 Apr 2010 | CVSS 7.5 | Red Hat JBoss Information DisclosureThe Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3… | Exploited |