| CVE-2016-1000229 | TRUNG BÌNH6.1 | swagger-ui has XSS in key names | 20/12/2019 |
| CVE-2014-0175 | NGHIÊM TRỌNG9.8 | mcollective has a default password set at install | 13/12/2019 |
| CVE-2014-0163 | CAO8.8 | Openshift has shell command injection flaws due to unsanitized data being passed into shell commands. | 11/12/2019 |
| CVE-2013-7370 | TRUNG BÌNH6.1 | node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware | 11/12/2019 |
| CVE-2013-0163 | TRUNG BÌNH5.5 | OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS | 05/12/2019 |
| CVE-2013-2103 | CAO8.1 | OpenShift cartridge allows remote URL retrieval | 03/12/2019 |
| CVE-2012-6135 | CAO7.5 | RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. | 19/11/2019 |
| CVE-2013-5123 | TRUNG BÌNH5.9 | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. | 05/11/2019 |
| CVE-2019-14845 | TRUNG BÌNH5.3 | A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this flaw by launching a man-in-the-middle attack and injecting malicious content. | 08/10/2019 |
| CVE-2019-3884 | TRUNG BÌNH5.4 | A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected. | 01/08/2019 |
| CVE-2019-5736 | CAO8.6 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, | 11/02/2019 |
| CVE-2018-14645 | CAO7.5 | A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service. | 21/09/2018 |
| CVE-2016-7075 | CAO8.1 | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate. | 10/09/2018 |
| CVE-2016-8651 | THẤP3.5 | An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image. | 01/08/2018 |
| CVE-2016-8631 | CAO7.7 | The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site. | 31/07/2018 |
| CVE-2018-10875 | CAO7.8 | A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. | 13/07/2018 |
| CVE-2018-10885 | CAO7.5 | In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster. | 05/07/2018 |
| CVE-2017-2611 | TRUNG BÌNH4.3 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise perform | 08/05/2018 |
| CVE-2018-1102 | CAO8.8 | A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation. | 30/04/2018 |
| CVE-2018-1059 | TRUNG BÌNH6.1 | The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vuln | 24/04/2018 |