CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Redhat : Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
451 CVE-2015-1210 Bypass 2015-02-06 2021-09-08
5.0
None Remote Low Not required None Partial None
The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
452 CVE-2015-0410 2015-01-21 2020-09-08
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.
453 CVE-2015-0407 2015-01-21 2020-09-08
5.0
None Remote Low Not required Partial None None
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
454 CVE-2015-0383 2015-01-21 2020-09-08
5.4
None Local Medium Not required None Partial Complete
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.
455 CVE-2015-0294 295 2020-01-27 2020-01-31
5.0
None Remote Low Not required None Partial None
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
456 CVE-2015-0248 399 DoS 2015-04-08 2018-10-30
5.0
None Remote Low Not required None None Partial
The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
457 CVE-2014-9750 20 DoS +Info 2015-10-06 2020-06-18
5.8
None Remote Medium Not required Partial None Partial
ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.
458 CVE-2014-9675 264 Bypass 2015-02-08 2018-10-30
5.0
None Remote Low Not required Partial None None
bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.
459 CVE-2014-9493 264 2015-01-07 2019-02-01
5.5
None Remote Low ??? Partial None Partial
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.
460 CVE-2014-9140 119 DoS Overflow 2014-12-05 2018-10-09
5.0
None Remote Low Not required None None Partial
Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
461 CVE-2014-8564 310 DoS 2014-11-13 2018-10-30
5.0
None Remote Low Not required None None Partial
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
462 CVE-2014-8163 22 Dir. Trav. 2017-08-28 2017-09-05
5.5
None Remote Low ??? None Partial Partial
Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.
463 CVE-2014-8160 20 Bypass 2015-03-02 2020-05-21
5.0
None Remote Low Not required None Partial None
net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.
464 CVE-2014-8119 20 DoS 2017-12-29 2019-04-22
5.0
None Remote Low Not required None None Partial
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions.
465 CVE-2014-8108 DoS 2014-12-18 2017-01-03
5.0
None Remote Low Not required None None Partial
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.
466 CVE-2014-8080 DoS 2014-11-03 2018-10-30
5.0
None Remote Low Not required None None Partial
The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.
467 CVE-2014-7968 310 DoS 2014-10-22 2014-10-23
5.0
None Remote Low Not required None None Partial
VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.
468 CVE-2014-7943 119 DoS Overflow 2015-01-22 2018-10-30
5.0
None Remote Low Not required None None Partial
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
469 CVE-2014-7941 119 DoS Overflow 2015-01-22 2018-10-30
5.0
None Remote Low Not required None None Partial
The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted X11 data.
470 CVE-2014-7823 255 2014-11-13 2017-01-03
5.0
None Remote Low Not required Partial None None
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
471 CVE-2014-7815 20 DoS 2014-11-14 2020-08-11
5.0
None Remote Low Not required None None Partial
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
472 CVE-2014-4975 119 DoS Overflow 2014-11-15 2017-08-29
5.0
None Remote Low Not required Partial None None
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.
473 CVE-2014-4615 200 +Info 2014-08-19 2017-01-07
5.0
None Remote Low Not required Partial None None
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).
474 CVE-2014-4342 119 DoS Overflow 2014-07-20 2020-01-21
5.0
None Remote Low Not required None None Partial
MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.
475 CVE-2014-4341 125 DoS 2014-07-20 2021-02-02
5.0
None Remote Low Not required None None Partial
MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.
476 CVE-2014-3703 264 Bypass 2014-12-02 2014-12-05
5.0
None Remote Low Not required None Partial None
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
477 CVE-2014-3675 125 DoS 2014-10-22 2021-04-07
5.0
None Remote Low Not required None None Partial
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.
478 CVE-2014-3662 200 +Info 2014-10-16 2016-06-14
5.0
None Remote Low Not required Partial None None
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.
479 CVE-2014-3661 399 DoS 2014-10-16 2016-06-13
5.0
None Remote Low Not required None None Partial
Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
480 CVE-2014-3660 DoS 2014-11-04 2016-12-08
5.0
None Remote Low Not required None None Partial
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
481 CVE-2014-3652 601 2019-12-15 2019-12-19
5.8
None Remote Medium Not required Partial Partial None
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
482 CVE-2014-3580 DoS 2014-12-18 2016-12-24
5.0
None Remote Low Not required None None Partial
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.
483 CVE-2014-3562 200 +Info 2014-08-21 2019-04-22
5.0
None Remote Low Not required Partial None None
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.
484 CVE-2014-3558 264 Bypass 2014-09-30 2019-03-21
5.0
None Remote Low Not required None Partial None
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
485 CVE-2014-3521 264 Bypass 2014-10-06 2014-10-07
5.5
None Remote Low ??? Partial Partial None
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
486 CVE-2014-3481 200 +Info 2014-07-07 2017-08-29
5.0
None Remote Low Not required Partial None None
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.
487 CVE-2014-3469 476 DoS 2014-06-05 2020-11-16
5.0
None Remote Low Not required None None Partial
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.
488 CVE-2014-3467 DoS 2014-06-05 2020-11-16
5.0
None Remote Low Not required None None Partial
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
489 CVE-2014-3464 264 2014-08-19 2017-08-29
5.5
None Remote Low ??? Partial Partial None
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.
490 CVE-2014-3199 399 DoS 2014-10-08 2016-11-28
5.0
None Remote Low Not required None None Partial
The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, has an erroneous fallback outcome for wrapper-selection failures, which allows remote attackers to cause a denial of service via vectors that trigger stopping a worker process that had been handling an Event object.
491 CVE-2014-3198 119 DoS Overflow 2014-10-08 2016-11-28
5.0
None Remote Low Not required None None Partial
The Instance::HandleInputEvent function in pdf/instance.cc in the PDFium component in Google Chrome before 38.0.2125.101 interprets a certain -1 value as an index instead of a no-visible-page error code, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
492 CVE-2014-3197 264 XSS +Info 2014-10-08 2016-11-28
5.0
None Remote Low Not required Partial None None
The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.
493 CVE-2014-3195 399 +Info 2014-10-08 2016-11-28
5.0
None Remote Low Not required Partial None None
Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-precision floating-point numbers, which allows remote attackers to obtain sensitive information via crafted JavaScript code, related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in heap/spaces-inl.h, the LargeObjectSpace::AllocateRaw function in heap/spaces.cc, and the Runtime_ArrayConcat function in runtime.cc.
494 CVE-2014-2686 670 2020-01-09 2020-01-21
5.0
None Remote Low Not required None Partial None
Ansible prior to 1.5.4 mishandles the evaluation of some strings.
495 CVE-2014-1505 200 Bypass +Info 2014-03-19 2020-08-05
5.0
None Remote Low Not required Partial None None
The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.
496 CVE-2014-1487 346 Bypass +Info 2014-02-06 2020-08-11
5.0
None Remote Low Not required Partial None None
The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
497 CVE-2014-1481 Bypass 2014-02-06 2020-08-11
5.0
None Remote Low Not required None Partial None
Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.
498 CVE-2014-1479 Bypass 2014-02-06 2020-08-10
5.0
None Remote Low Not required None Partial None
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
499 CVE-2014-0418 2014-01-15 2020-09-08
5.1
None Remote High Not required Partial Partial Partial
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424.
500 CVE-2014-0224 326 +Info 2014-06-05 2021-11-17
5.8
None Remote Medium Not required Partial Partial None
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
Total number of vulnerabilities : 690   Page : 1 2 3 4 5 6 7 8 9 10 (This Page)11 12 13 14
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.