CveMateVulnerability intelligence

Redhat Openshift vulnerabilities, page 5

146 vulnerabilities

Known vulnerabilities in Redhat Openshift, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2016-3726jenkinsjenkins+210y ago17-05-2016 14:00

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.CVE-2016-3711redhatopenshift+110y ago08-06-2016 17:00

HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.CVE-2016-3708redhatopenshift10y ago08-06-2016 17:00

Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that (1) contains ONBUILD commands or (2) does not contain a tar binary.CVE-2016-3725jenkinsjenkins+210y ago17-05-2016 14:00

Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).CVE-2025-14512debianglib2.0+410mo ago11-12-2025 07:11

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.CVE-2020-1759debianceph+706y ago13-04-2020 12:04

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.CVE-2020-1707redhatopenshift+16y ago20-03-2020 00:00

A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/postgresql-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.CVE-2020-1761redhatopenshift5y ago27-05-2021 19:45

A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser. This flaw affects openshift/console versions before openshift/console-4.CVE-2020-1709redhatopenshift+16y ago20-03-2020 00:00

A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.CVE-2020-10715redhatopenshift6y ago16-09-2020 18:00

A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate.CVE-2020-35514redhatopenshift5y ago02-06-2021 13:22

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0-202105111858.p0.CVE-2014-1869debiandb4o+312y ago08-02-2014 00:00

Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).CVE-2014-0188redhatopenshift+212y ago24-04-2014 14:00

The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.CVE-2014-0163openshiftopenshift+16y ago11-12-2019 15:33

Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.CVE-2014-0234redhatopenshift6y ago12-02-2020 00:09

The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.CVE-2014-0164debianmcollective+212y ago05-05-2014 17:00

openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.CVE-2014-0023openshiftopenshift+16y ago15-11-2019 14:40

OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution CVE-2014-0175debianmcollective+56y ago13-12-2019 12:40

mcollective has a default password set at install CVE-2014-0233redhatopenshift+111y ago16-11-2014 11:00

Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.CVE-2014-3661jenkinsjenkins+212y ago16-10-2014 19:00

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.