OP
Product
Openshift
On CISA KEVExploited in the wild
145
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 47Medium 42Low 5
Watch
Add Openshift to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-8651 | 3.5 | Aug 1 | An input validation flaw was found in the way OpenShift 3 handles requests for images Affected: 3.0 |
| CVE-2015-0238 | 3.3 | Sep 26 | selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack Affected: 2.0 |
| CVE-2016-3711 | 3.3 | Jun 8 | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID"… Affected: 3.2 |
| CVE-2015-7561 | 3.1 | Aug 7 | Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image Affected: 3.0 |
| CVE-2015-5326 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to… Affected: through 3.1; 2.0 |
| CVE-2015-5325 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave Affected: through 3.1; 2.0 |
| CVE-2015-5324 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to queue/api Affected: 2.0; through 3.1 |
| CVE-2015-5323 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an… Affected: through 3.1; 2.0 |
| CVE-2015-5322 | – | Nov 25 | Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet… Affected: through 3.1; 2.0 |
| CVE-2015-5321 | – | Nov 25 | The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct… Affected: through 3.1; 2.0 |
| CVE-2015-5320 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain… Affected: through 3.1; 2.0 |
| CVE-2015-5319 | – | Nov 25 | XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted… Affected: through 3.1; 2.0 |
| CVE-2015-5318 | – | Nov 25 | Jenkins before 1.638 and LTS before 1.625.2 uses a publicly accessible salt to generate CSRF protection tokens, which makes it easier for remote attackers to bypass the CSRF… Affected: through 3.1; 2.0 |
| CVE-2015-5305 | – | Nov 6 | Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is… Affected: 3.0 |
| CVE-2015-1814 | – | Oct 16 | The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users Affected: through 3.1 |
| CVE-2015-1813 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a… Affected: through 3.1 |
| CVE-2015-1812 | – | Oct 16 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a… Affected: through 3.1 |
| CVE-2015-1810 | – | Oct 16 | The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting,… Affected: through 3.1 |
| CVE-2015-1808 | – | Oct 16 | Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data Affected: through 3.1 |
| CVE-2015-1807 | – | Oct 16 | Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink,… Affected: through 3.1 |
| CVE-2015-1806 | – | Oct 16 | The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and… Affected: through 3.1 |
| CVE-2015-5274 | – | Sep 18 | rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker Affected: 2.2 |
| CVE-2015-5222 | – | Aug 24 | Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with… Affected: 3.0.0.0 |
| CVE-2014-0233 | – | Nov 16 | Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is… Affected: 2.0; 2.1 |
| CVE-2014-3674 | – | Nov 13 | Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via… Affected: through 2.1.8; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +10 more |
| CVE-2014-3602 | – | Nov 13 | Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp Affected: through 2.1.8; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +10 more |
| CVE-2014-3680 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized… Affected: through 3.1 |
| CVE-2014-3667 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain… Affected: through 3.1 |
| CVE-2014-3666 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel Affected: through 3.1 |
| CVE-2014-3663 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary… Affected: through 3.1 |
| CVE-2014-3662 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts Affected: through 3.1 |
| CVE-2014-3661 | – | Oct 16 | Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake Affected: through 3.1 |
| CVE-2014-3681 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 3.1 |
| CVE-2014-3664 | – | Oct 15 | Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via… Affected: through 3.1 |
| CVE-2014-3496 | – | Jun 20 | cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url… Affected: 1.2.8; 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +4 more |
| CVE-2014-0164 | – | May 5 | openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which… Affected: 1.2.7; 2.0.5 |
| CVE-2014-0188 | – | Apr 24 | The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which… Affected: through 1.2.7; 2.0 through 2.0.5 |
| CVE-2014-1869 | – | Feb 8 | Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M Affected: through 3.1 |
| CVE-2013-2119 | – | Jan 3 | Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating… Affected: 1.0 |
| CVE-2013-2186 | – | Oct 28 | The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote… Affected: through 3.1 |
| CVE-2013-0164 | – | Feb 24 | The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a… Affected: through 1.0 |
| CVE-2012-5658 | – | Feb 24 | rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent… Affected: through 1.0 |
| CVE-2012-5647 | – | Feb 24 | Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and… Affected: 1.0 |
| CVE-2012-5646 | – | Feb 24 | node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO Affected: 1.0 |
| CVE-2012-5622 | – | Dec 18 | Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in OpenShift 0.0.5 allows remote attackers… Affected: 0.0.5 |