Filtered by vendor Redhat Subscriptions
Filtered by product Quay Subscriptions
Total 83 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-3866 1 Redhat 3 Openstack, Openstack-mistral, Quay 2024-11-21 5.5 Medium
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.
CVE-2019-3865 1 Redhat 1 Quay 2024-11-21 6.1 Medium
A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.
CVE-2019-3864 1 Redhat 1 Quay 2024-11-21 8.8 High
A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.
CVE-2019-20922 2 Handlebarsjs, Redhat 5 Handlebars, Jboss Enterprise Bpms Platform, Openshift and 2 more 2024-11-21 7.5 High
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
CVE-2019-20920 2 Handlebarsjs, Redhat 5 Handlebars, Jboss Enterprise Bpms Platform, Openshift and 2 more 2024-11-21 8.1 High
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
CVE-2019-20477 3 Fedoraproject, Pyyaml, Redhat 4 Fedora, Pyyaml, Enterprise Linux and 1 more 2024-11-21 9.8 Critical
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
CVE-2019-19911 5 Canonical, Debian, Fedoraproject and 2 more 5 Ubuntu Linux, Debian Linux, Fedora and 2 more 2024-11-21 7.5 High
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
CVE-2019-16789 5 Agendaless, Debian, Fedoraproject and 2 more 6 Waitress, Debian Linux, Fedora and 3 more 2024-11-21 7.1 High
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
CVE-2019-16786 5 Agendaless, Debian, Fedoraproject and 2 more 6 Waitress, Debian Linux, Fedora and 3 more 2024-11-21 7.1 High
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
CVE-2019-16785 5 Agendaless, Debian, Fedoraproject and 2 more 6 Waitress, Debian Linux, Fedora and 3 more 2024-11-21 7.1 High
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
CVE-2019-10773 2 Redhat, Yarnpkg 2 Quay, Yarn 2024-11-21 7.8 High
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
CVE-2019-10205 1 Redhat 1 Quay 2024-11-21 6.3 Medium
A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.
CVE-2019-1010266 2 Lodash, Redhat 2 Lodash, Quay 2024-11-21 6.5 Medium
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
CVE-2018-3774 2 Redhat, Url-parse Project 2 Quay, Url-parse 2024-11-21 9.8 Critical
Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
CVE-2018-3728 2 Hapijs, Redhat 3 Hoek, Mobile Application Platform, Quay 2024-11-21 N/A
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVE-2018-3721 3 Lodash, Netapp, Redhat 4 Lodash, Active Iq Unified Manager, System Manager and 1 more 2024-11-21 6.5 Medium
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVE-2018-21270 2 Nodejs, Redhat 2 Node.js, Quay 2024-11-21 6.5 Medium
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
CVE-2018-1109 2 Braces Project, Redhat 2 Braces, Quay 2024-11-21 5.3 Medium
A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
CVE-2018-1107 2 Is-my-json-valid Project, Redhat 2 Is-my-json-valid, Quay 2024-11-21 5.3 Medium
It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
CVE-2018-16492 2 Extend Project, Redhat 2 Extend, Quay 2024-11-21 N/A
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.