Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openshift vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2019-14892
A flaw exists in jackson-databind in versions prior to 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Fasterxml Jackson-databind
Redhat Jboss Enterprise Application Platform 7.0
Redhat Decision Manager 7.0
Redhat Jboss Fuse 7.0.0
Redhat Process Automation 7.0
Redhat Jboss Data Grid 7.0.0
Redhat Openshift Container Platform 4.3
Redhat Jboss Data Grid -
Apache Geode 1.12.0
1 Github repository
9.8
CVSSv3
CVE-2020-1731
A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.
Redhat Keycloak Operator
9.8
CVSSv3
CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x prior to 2.1 has a password of "mooo" for a Mongo account, which allows remote malicious users to hijack the broker by providing this password, related to the openshift.sh script in Openshift E...
Redhat Openshift
9.8
CVSSv3
CVE-2015-8011
Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd prior to 0.8.0 allows remote malicious users to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.
Lldpd Project Lldpd
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Fedoraproject Fedora 33
9.8
CVSSv3
CVE-2013-2060
The download_from_url function in OpenShift Origin allows remote malicious users to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.
Redhat Openshift 1.0
9.8
CVSSv3
CVE-2020-5312
libImaging/PcxDecode.c in Pillow prior to 6.2.2 has a PCX P mode buffer overflow.
Python Pillow
Canonical Ubuntu Linux 16.04
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Canonical Ubuntu Linux 18.04
Fedoraproject Fedora 30
Canonical Ubuntu Linux 14.04
Canonical Ubuntu Linux 19.10
Fedoraproject Fedora 31
9.8
CVSSv3
CVE-2019-18801
An issue exists in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass...
Envoyproxy Envoy
9.8
CVSSv3
CVE-2019-18802
An issue exists in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "ex...
Envoyproxy Envoy
9.8
CVSSv3
CVE-2014-0175
mcollective has a default password set at install
Puppet Marionette Collective -
Redhat Openshift 2.1
Redhat Openshift 1.0
Debian Debian Linux 8.0
Debian Debian Linux 10.0
9.8
CVSSv3
CVE-2013-2095
rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
Openshift-origin-controller Project Openshift-origin-controller -
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-7073
CVE-2024-5496
CVE-2024-5495
XPath injection
bypass
CVE-2024-30043
CVE-2024-24919
denial of service
CVE-2024-35468
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
6
7
8
9
10
NEXT »