Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Build Of Keycloak
MEDIUM 6.5
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of …
Apicast
HIGH 7.5
A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This coul…
Network Observability
HIGH 7.5
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentic…
Subscription Manager
HIGH 7.8
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.red…
Device Mapper Multipath
HIGH 7.8
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in…
Certificate System
MEDIUM 5.7
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled.…
Cloudforms
HIGH 8.1
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a…
Openstack Selinux
MEDIUM 6.5
An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from pri…
Satellite
MEDIUM 6.5
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a mali…
Enterprise Linux
HIGH 7.5
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove …
Undertow
CRITICAL 9.8
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final …
Satellite
CRITICAL 9.1
From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privil…
Enterprise Linux
HIGH 7.0
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is p…
Satellite
HIGH 7.2
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered…
Ceph
MEDIUM 5.7
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used in ceph d…
Keycloak
HIGH 8.1
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit th…
Enterprise Linux Server
HIGH 7.8
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged accou…
Cloudforms Management Engine
HIGH 8.8
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authent…
Jboss Fuse
CRITICAL 9.0
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored …
Ceph Storage
HIGH 8.1
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage po…
Setup
MEDIUM 5.3
setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates sec…
Keycloak
HIGH 7.2
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permit…
Pagure
HIGH 7.5
Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization