| http-cache-semantics vulnerable to Regular Expression Denial of ServiceCVE-2022-25881 · GHSA-RC47-6667-2J5J |
org.webjars.npm:http-cache-semanticshttp-cache-semantics |
MavennpmRed HatWordPress |
High
|
Fix reported |
|
| minimatch ReDoS vulnerabilityCVE-2022-3517 · GHSA-F8Q6-P94X-37V3 |
minimatchMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto/ssh Denial of service via crafted SignerCVE-2022-27191 · GHSA-8C26-WMH5-6G9VVersion ranges need review. |
golang.org/x/cryptoMigration Toolkit for Containers/cpma |
GoRed Hat |
High
|
Fix reported |
|
| Exposure of Sensitive Information to an Unauthorized Actor in follow-redirectsCVE-2022-0536 · GHSA-PW2R-VQ6V-HR8C |
follow-redirects.NET Core 3.1 on Red Hat Enterprise Linux/rh-dotnet31-dotnet |
npmRed Hat |
Medium
|
Fix reported |
|
| Mattermost fails to limit the number of active sessionsCVE-2024-4183 · GHSA-WJ37-MPQ9-XRCMVersion ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost crashes web clients via a malformed custom statusCVE-2024-4182 · GHSA-8F99-G2PJ-X8W3Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost's detailed error messages reveal the full file pathCVE-2024-32046 · GHSA-VX97-8Q8Q-QGQ5Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost allows team admins to promote guests to team adminsCVE-2024-4195 · GHSA-5FH7-7MW7-MMX5Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
| Mattermost fails to limit the size of a request pathCVE-2024-22091 · GHSA-P2WQ-4GGP-45F3Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
| Mattermost fails to fully validate role changesCVE-2024-4198 · GHSA-5QX9-9FFJ-5R8FVersion ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
| Helm vulnerable to denial of service through string value parsingCVE-2022-23524 · GHSA-6RX9-889Q-VV2RVersion ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/jenkins-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to denial of service through schema fileCVE-2022-23526 · GHSA-67FX-WX78-JX33Version ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/helm |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to denial of service through through repository index fileCVE-2022-23525 · GHSA-53C4-HHMH-VW5QVersion ranges need review. |
helm.sh/helm/v3OpenShift Developer Tools and Services/jenkins-operator-container |
GoRed Hat |
Medium
|
Fix reported |
|
| qs vulnerable to Prototype PollutionCVE-2022-24999 · GHSA-HRPP-H998-J3PP |
qs.NET Core 3.1 on Red Hat Enterprise Linux/rh-dotnet31-dotnet |
npmRed Hat |
High
|
Fix reported |
|
| Improper Verification of Cryptographic Signature in node-forgeCVE-2022-24772 · GHSA-X4JG-MJRX-434G |
node-forgeMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| Improper Verification of Cryptographic Signature in node-forgeCVE-2022-24771 · GHSA-CFM4-QJH2-4765 |
node-forgeMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| Improper Validation of Integrity Check Value in go-tufCVE-2022-29173 · GHSA-66X3-6CW3-V5GJVersion ranges need review. |
github.com/theupdateframework/go-tufRed Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-docs-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| cosign's `cosign verify-attestaton --type` can report a false positive if any attestation existsCVE-2022-35929 · GHSA-VJXV-45G9-9296Version ranges need review. |
github.com/sigstore/cosignOpenShift Serverless/openshift-serverless-1/client-kn-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| node-fetch forwards secure headers to untrusted sitesCVE-2022-0235 · GHSA-R683-J2X4-V87G |
node-fetch.NET Core 3.1 on Red Hat Enterprise Linux/rh-dotnet31-dotnet |
npmRed Hat |
High
|
Fix reported |
|
| file-type vulnerable to Infinite Loop via malformed MKV fileCVE-2022-36313 · GHSA-MHXJ-85R3-2X55 |
file-typeMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
