Filtered by vendor Redhat Subscriptions
Total 22995 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-1323 2 Apache, Redhat 2 Tomcat Jk Connector, Jboss Core Services 2024-11-21 N/A
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
CVE-2018-1320 5 Apache, Debian, F5 and 2 more 6 Thrift, Debian Linux, Traffix Signaling Delivery Controller and 3 more 2024-11-21 7.5 High
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
CVE-2018-1312 5 Apache, Canonical, Debian and 2 more 15 Http Server, Ubuntu Linux, Debian Linux and 12 more 2024-11-21 9.8 Critical
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
CVE-2018-1311 5 Apache, Debian, Fedoraproject and 2 more 11 Xerces-c\+\+, Debian Linux, Fedora and 8 more 2024-11-21 8.1 High
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
CVE-2018-1305 5 Apache, Canonical, Debian and 2 more 10 Tomcat, Ubuntu Linux, Debian Linux and 7 more 2024-11-21 N/A
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
CVE-2018-1304 5 Apache, Canonical, Debian and 2 more 13 Tomcat, Ubuntu Linux, Debian Linux and 10 more 2024-11-21 N/A
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
CVE-2018-1303 5 Apache, Canonical, Debian and 2 more 10 Http Server, Ubuntu Linux, Debian Linux and 7 more 2024-11-21 N/A
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
CVE-2018-1302 4 Apache, Canonical, Netapp and 1 more 7 Http Server, Ubuntu Linux, Clustered Data Ontap and 4 more 2024-11-21 N/A
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
CVE-2018-1301 5 Apache, Canonical, Debian and 2 more 10 Http Server, Ubuntu Linux, Debian Linux and 7 more 2024-11-21 N/A
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.
CVE-2018-1295 2 Apache, Redhat 2 Ignite, Jboss Fuse 2024-11-21 N/A
In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
CVE-2018-1288 3 Apache, Oracle, Redhat 6 Kafka, Database, Primavera P6 Enterprise Project Portfolio Management and 3 more 2024-11-21 5.4 Medium
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
CVE-2018-1283 5 Apache, Canonical, Debian and 2 more 10 Http Server, Ubuntu Linux, Debian Linux and 7 more 2024-11-21 N/A
In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.
CVE-2018-1275 3 Oracle, Redhat, Vmware 21 Application Testing Suite, Big Data Discovery, Communications Converged Application Server and 18 more 2024-11-21 9.8 Critical
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVE-2018-1272 3 Oracle, Redhat, Vmware 27 Application Testing Suite, Big Data Discovery, Communications Converged Application Server and 24 more 2024-11-21 7.5 High
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
CVE-2018-1271 3 Oracle, Redhat, Vmware 30 Application Testing Suite, Big Data Discovery, Communications Converged Application Server and 27 more 2024-11-21 5.9 Medium
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2018-1270 4 Debian, Oracle, Redhat and 1 more 29 Debian Linux, Application Testing Suite, Big Data Discovery and 26 more 2024-11-21 9.8 Critical
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CVE-2018-1260 2 Pivotal Software, Redhat 3 Spring Security Oauth, Jboss Fuse, Openshift Application Runtimes 2024-11-21 N/A
Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.
CVE-2018-1259 3 Pivotal Software, Redhat, Xmlbeam 5 Spring Data Commons, Spring Data Rest, Jboss Fuse and 2 more 2024-11-21 N/A
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVE-2018-1258 5 Netapp, Oracle, Pivotal Software and 2 more 43 Oncommand Insight, Oncommand Unified Manager, Oncommand Workflow Automation and 40 more 2024-11-21 8.8 High
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
CVE-2018-1257 3 Oracle, Redhat, Vmware 32 Agile Product Lifecycle Management, Application Testing Suite, Big Data Discovery and 29 more 2024-11-21 6.5 Medium
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.