Vulnerabilidades em Red Hat

2.456 resultados
Análise Vexday

Com 1.477 CVEs catalogadas e 232 surgidas apenas nos últimos 90 dias, o volume de vulnerabilidades associadas ao Red Hat exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com apenas 1 CVE confirmada no CISA KEV — a CVE-2023-4911, que apresenta EPSS de 0,7861, indicando probabilidade elevada de exploração e merecendo atenção prioritária de equipes de resposta. Das 34 vulnerabilidades de severidade crítica, 18 contam com prova de conceito pública disponível, o que reduz a barreira técnica para exploração e aumenta o risco operacional. O tipo de falha mais recorrente é CWE-125 (leitura fora dos limites), padrão que frequentemente viabiliza vazamento de dados ou corrupção de memória e deve orientar revisões de hardening e priorização de patches.

CVE-2023-4091MEDIUMSamba: smb clients can truncate files with read-only permissionsEPSS 1.3%CVE-2023-34968MEDIUMSamba: spotlight server-side share path disclosureEPSS 1.3%CVE-2025-12543CRITICALUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfEPSS 1.3%CVE-2024-9676MEDIUMPodman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)EPSS 1.3%CVE-2019-19337MEDIUMA flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker cEPSS 1.3%CVE-2023-6134MEDIUMKeycloak: reflected xss via wildcard in oidc redirect_uriEPSS 1.3%CVE-2023-40661MEDIUMOpensc: multiple memory issues with pkcs15-init (enrollment tool)EPSS 1.3%CVE-2019-14878MEDIUMIn the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aEPSS 1.3%CVE-2023-42670MEDIUMSamba: ad dc busy rpc multiple listener dosEPSS 1.3%CVE-2026-76578CRITICALIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciEPSS 1.3%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.3%CVE-2023-3637MEDIUMOpenstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)EPSS 1.3%CVE-2017-2664MEDIUMCloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portEPSS 1.3%CVE-2025-7424HIGHLibxslt: type confusion in xmlnode.psvi between stylesheet and source nodesEPSS 1.3%CVE-2012-4549MEDIUMJboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorizationEPSS 1.3%CVE-2025-12548CRITICALGithub.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333EPSS 1.3%CVE-2019-14877MEDIUMIn the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocateEPSS 1.3%CVE-2017-2674MEDIUMJBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sEPSS 1.3%CVE-2023-41175MEDIUMLibtiff: potential integer overflow in raw2tiff.cEPSS 1.3%CVE-2023-3269HIGHDistros-[dirtyvma] privilege escalation via non-rcu-protected vma traversalEPSS 1.3%