Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1621 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-3592 1 Redhat 1 Openshift Origin 2024-11-21 6.1 Medium
OpenShift Origin: Improperly validated team names could allow stored XSS attacks
CVE-2014-0234 1 Redhat 1 Openshift 2024-11-21 9.8 Critical
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
CVE-2014-0175 3 Debian, Puppet, Redhat 3 Debian Linux, Marionette Collective, Openshift 2024-11-21 9.8 Critical
mcollective has a default password set at install
CVE-2014-0163 1 Redhat 1 Openshift 2024-11-21 8.8 High
Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
CVE-2014-0084 1 Redhat 2 Openshift, Openshift Origin 2024-11-21 5.5 Medium
Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
CVE-2014-0068 1 Redhat 2 Openshift, Openshift-origin-node-util 2024-11-21 5.5 Medium
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.
CVE-2014-0023 1 Redhat 1 Openshift 2024-11-21 7.8 High
OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution
CVE-2013-7370 4 Debian, Opensuse, Redhat and 1 more 4 Debian Linux, Opensuse, Openshift and 1 more 2024-11-21 6.1 Medium
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
CVE-2013-5123 5 Debian, Fedoraproject, Pypa and 2 more 6 Debian Linux, Fedora, Pip and 3 more 2024-11-21 5.9 Medium
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
CVE-2013-4561 1 Redhat 1 Openshift 2024-11-21 9.1 Critical
In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
CVE-2013-4364 1 Redhat 1 Openshift 2024-11-21 N/A
(1) oo-analytics-export and (2) oo-analytics-import in the openshift-origin-broker-util package in Red Hat OpenShift Enterprise 1 and 2 allow local users to have unspecified impact via a symlink attack on an unspecified file in /tmp.
CVE-2013-2103 1 Redhat 1 Openshift 2024-11-21 8.1 High
OpenShift cartridge allows remote URL retrieval
CVE-2013-2060 1 Redhat 1 Openshift 2024-11-21 9.8 Critical
The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.
CVE-2013-0196 1 Redhat 2 Enterprise Linux, Openshift 2024-11-21 6.5 Medium
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.
CVE-2013-0165 1 Redhat 1 Openshift 2024-11-21 7.3 High
cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.
CVE-2013-0163 1 Redhat 1 Openshift 2024-11-21 5.5 Medium
OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS
CVE-2012-6685 2 Nokogiri, Redhat 9 Nokogiri, Cloudforms Management Engine, Cloudforms Managementengine and 6 more 2024-11-21 7.5 High
Nokogiri before 1.5.4 is vulnerable to XXE attacks
CVE-2012-6135 2 Phusion, Redhat 2 Passenger, Openshift 2024-11-21 7.5 High
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.
CVE-2024-0793 1 Redhat 1 Openshift 2024-11-18 7.7 High
A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
CVE-2024-21534 2 Jsonpath-plus, Redhat 3 Jsonpath, Openshift Devspaces, Rhdh 2024-11-18 9.8 Critical
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).