Libssh: out-of-bounds read in sftp_handle()

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token

A flaw was found in Keycloak in the execute-actions-email endpoint

A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a…

A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and…

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site…

An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java,…

A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11

Sssd: sssd: information disclosure via query injection in entra id lookups

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

Gnutls: vulnerability in gnutls sct extension parsing

A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query

A content spoofing flaw was found in OpenShift's OAuth endpoint

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit

The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively,…

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions

An information disclosure vulnerability was found in containers/podman in versions before 2.0.5

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation

Binutils: binutils: denial of service via crafted elf file

Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable…

The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens

A flaw was found in python-oslo-utils

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site…

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers…

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin

Sssd: sssd: denial of service via race condition in autofs responder

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area

Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A vulnerability was found in Buildah

A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl…

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted,…

Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection

It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the…

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission…

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a…

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to…

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier