Filtered by vendor Redhat Subscriptions
Filtered by product Rhmt Subscriptions
Total 136 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-0686 2 Redhat, Url-parse Project 2 Rhmt, Url-parse 2024-11-21 9.1 Critical
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
CVE-2022-0639 2 Redhat, Url-parse Project 2 Rhmt, Url-parse 2024-11-21 5.3 Medium
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
CVE-2022-0536 2 Follow-redirects Project, Redhat 7 Follow-redirects, Acm, Openshift Data Foundation and 4 more 2024-11-21 2.6 Low
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
CVE-2022-0512 2 Redhat, Url-parse Project 2 Rhmt, Url-parse 2024-11-21 5.3 Medium
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
CVE-2022-0235 4 Debian, Node-fetch Project, Redhat and 1 more 14 Debian Linux, Node-fetch, Acm and 11 more 2024-11-21 6.1 Medium
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVE-2021-44717 4 Debian, Golang, Opengroup and 1 more 10 Debian Linux, Go, Unix and 7 more 2024-11-21 4.8 Medium
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
CVE-2021-44716 4 Debian, Golang, Netapp and 1 more 16 Debian Linux, Go, Cloud Insights Telegraf and 13 more 2024-11-21 7.5 High
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
CVE-2021-43138 3 Async Project, Fedoraproject, Redhat 4 Async, Fedora, Rhmt and 1 more 2024-11-21 7.8 High
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
CVE-2021-41772 4 Fedoraproject, Golang, Oracle and 1 more 8 Fedora, Go, Timesten In-memory Database and 5 more 2024-11-21 7.5 High
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
CVE-2021-41771 4 Debian, Fedoraproject, Golang and 1 more 6 Debian Linux, Fedora, Go and 3 more 2024-11-21 7.5 High
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
CVE-2021-41190 3 Fedoraproject, Linuxfoundation, Redhat 10 Fedora, Open Container Initiative Distribution Specification, Open Container Initiative Image Format Specification and 7 more 2024-11-21 3 Low
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
CVE-2021-3948 2 Konveyor, Redhat 4 Mig-controller, Enterprise Linux, Migration Toolkit and 1 more 2024-11-21 6.3 Medium
An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migrate a malicious workload to the target cluster, impacting confidentiality, integrity, and availability of the services located on that cluster.
CVE-2021-3807 3 Ansi-regex Project, Oracle, Redhat 10 Ansi-regex, Communications Cloud Native Core Policy, Acm and 7 more 2024-11-21 7.5 High
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3757 2 Immer Project, Redhat 2 Immer, Rhmt 2024-11-21 9.8 Critical
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2021-3749 4 Axios, Oracle, Redhat and 1 more 9 Axios, Goldengate, Acm and 6 more 2024-11-21 7.5 High
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3541 4 Netapp, Oracle, Redhat and 1 more 29 Active Iq Unified Manager, Cloud Backup, Clustered Data Ontap and 26 more 2024-11-21 6.5 Medium
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2021-3537 6 Debian, Fedoraproject, Netapp and 3 more 21 Debian Linux, Fedora, Active Iq Unified Manager and 18 more 2024-11-21 5.9 Medium
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
CVE-2021-3520 5 Lz4 Project, Netapp, Oracle and 2 more 12 Lz4, Active Iq Unified Manager, Cloud Backup and 9 more 2024-11-21 9.8 Critical
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.
CVE-2021-3518 6 Debian, Fedoraproject, Netapp and 3 more 20 Debian Linux, Fedora, Active Iq Unified Manager and 17 more 2024-11-21 8.8 High
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
CVE-2021-3517 6 Debian, Fedoraproject, Netapp and 3 more 30 Debian Linux, Fedora, Active Iq Unified Manager and 27 more 2024-11-21 8.6 High
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.