Filtered by vendor Redhat Subscriptions
Total 23274 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-1550 3 Debian, Mozilla, Redhat 8 Debian Linux, Firefox, Thunderbird and 5 more 2025-03-27 6.1 Medium
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
CVE-2024-5693 2 Mozilla, Redhat 7 Firefox, Thunderbird, Enterprise Linux and 4 more 2025-03-27 6.1 Medium
Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVE-2022-25881 2 Http-cache-semantics Project, Redhat 8 Http-cache-semantics, Acm, Enterprise Linux and 5 more 2025-03-27 5.3 Medium
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVE-2024-41909 2 Apache, Redhat 2 Mina Sshd, Jboss Enterprise Application Platform 2025-03-27 5.9 Medium
Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack The mitigations to prevent this type of attack were implemented in Apache MINA SSHD 2.12.0, both client and server side. Users are recommended to upgrade to at least this version. Note that both the client and the server implementation must have mitigations applied against this issue, otherwise the connection may still be affected.
CVE-2024-1552 4 Debian, Linux, Mozilla and 1 more 9 Debian Linux, Linux Kernel, Firefox and 6 more 2025-03-27 7.5 High
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
CVE-2023-23969 3 Debian, Djangoproject, Redhat 5 Debian Linux, Django, Rhui and 2 more 2025-03-27 7.5 High
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVE-2022-4254 2 Fedoraproject, Redhat 16 Sssd, Enterprise Linux, Enterprise Linux Desktop and 13 more 2025-03-27 8.8 High
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVE-2022-48624 2 Greenwoodsoftware, Redhat 4 Less, Enterprise Linux, Logging and 1 more 2025-03-27 7.8 High
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
CVE-2022-28331 3 Apache, Microsoft, Redhat 4 Portable Runtime, Windows, Jboss Core Services and 1 more 2025-03-27 9.8 Critical
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
CVE-2022-24963 2 Apache, Redhat 4 Portable Runtime, Enterprise Linux, Jboss Core Services and 1 more 2025-03-27 9.8 Critical
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
CVE-2024-1553 3 Debian, Mozilla, Redhat 9 Debian Linux, Firefox, Firefox Esr and 6 more 2025-03-27 8.1 High
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
CVE-2024-1549 3 Debian, Mozilla, Redhat 8 Debian Linux, Firefox, Thunderbird and 5 more 2025-03-27 6.1 Medium
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
CVE-2024-1548 3 Debian, Mozilla, Redhat 8 Debian Linux, Firefox, Thunderbird and 5 more 2025-03-27 4.3 Medium
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
CVE-2024-1546 3 Debian, Mozilla, Redhat 9 Debian Linux, Firefox, Firefox Esr and 6 more 2025-03-27 7.5 High
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
CVE-2022-43922 2 Ibm, Redhat 2 App Connect Enterprise Certified Container, Openshift 2025-03-26 5.3 Medium
IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak hash of an API Key in the configuration. IBM X-Force ID: 241583.
CVE-2022-3560 3 Fedoraproject, Pesign Project, Redhat 7 Fedora, Pesign, Enterprise Linux and 4 more 2025-03-26 5.5 Medium
A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.
CVE-2021-37501 2 Hdfgroup, Redhat 2 Hdf5, Enterprise Linux Ai 2025-03-26 7.5 High
Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c.
CVE-2024-5690 3 Debian, Mozilla, Redhat 9 Debian Linux, Firefox, Firefox Esr and 6 more 2025-03-26 4.3 Medium
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVE-2023-25193 3 Fedoraproject, Harfbuzz Project, Redhat 8 Fedora, Harfbuzz, Enterprise Linux and 5 more 2025-03-26 7.5 High
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
CVE-2024-29156 2 Openstack, Redhat 3 Murano, Yaql, Openstack 2025-03-25 6.5 Medium
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.