Redhat Openshift vulnerabilities, page 3
146 vulnerabilities
Known vulnerabilities in Redhat Openshift, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2015-7561chainguardkubernetes-1.30+14
EPSS score1.42%
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.CVE-2015-5305github.com/kuberneteskubernetes+8EPSS score1.85%
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.CVE-2015-5326jenkinsjenkins+2EPSS score1.79%
Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.CVE-2015-5319jenkinsjenkins+2EPSS score2.34%
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.CVE-2015-5274redhatopenshift+1EPSS score2.13%
rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.CVE-2015-5324jenkinsjenkins+2EPSS score2.06%
Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api.CVE-2015-5317jenkinsjenkins+2KEVEPSS score23.00%
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.CVE-2015-5320jenkinsjenkins+2EPSS score2.12%
Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave.CVE-2015-5321jenkinsjenkins+2EPSS score2.06%
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages.CVE-2015-5323jenkinsjenkins+2EPSS score1.49%
Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.CVE-2015-5254apacheactivemq+5EPSS score38.19%
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.CVE-2015-5322jenkinsjenkins+2EPSS score3.16%
Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.CVE-2015-5222redhatopenshift+6EPSS score2.68%
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.CVE-2015-5325jenkinsjenkins+2EPSS score1.79%
Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3665.CVE-2015-5318jenkinsjenkins+2EPSS score1.16%
Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF protection mechanism via a brute force attack.CVE-2016-2142redhatopenshift+10EPSS score0.35%
Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by reading the file.CVE-2016-2160redhatopenshift+1EPSS score4.14%
Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image.CVE-2016-2074debianopenvswitch+10EPSS score6.40%
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.CVE-2016-2149redhatopenshiftEPSS score1.57%
Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace.CVE-2016-1000229Npmswagger-ui+3EPSS score4.04%
swagger-ui has XSS in key names