Filtered by vendor Redhat Subscriptions
Filtered by product Openshift Ai Subscriptions
Total 43 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-6019 2 Ray Project, Redhat 2 Ray, Openshift Ai 2025-08-07 9.8 Critical
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVE-2025-22868 2 Go, Redhat 19 Jws, Acm, Advanced Cluster Security and 16 more 2025-05-01 7.5 High
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
CVE-2024-49767 2 Palletsprojects, Redhat 3 Quart, Werkzeug, Openshift Ai 2025-01-03 7.5 High
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.