Storage (Redhat) - vulnerabilities (CVEs)

41 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2025-01-09. Vendor: Redhat.

CVEs of Storage

CVE-2025-0306 - CVSS 7.4 (high), 2025-01-09: A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted…
CVE-2020-25720 - CVSS 7.5 (high), 2024-11-17: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the…
CVE-2024-9355 - CVSS 6.5 (medium), 2024-10-01: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed…
CVE-2024-1394 - CVSS 7.5 (high), 2024-03-21: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using…
CVE-2023-48795 - CVSS 5.9 (medium), 2023-12-18: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks…
CVE-2023-4154 - CVSS 7.5 (high), 2023-11-07: A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only…
CVE-2023-42669 - CVSS 6.5 (medium), 2023-11-06: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability…
CVE-2023-3961 - CVSS 9.8 (critical), 2023-11-03: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba…
CVE-2023-4091 - CVSS 6.5 (medium), 2023-11-03: A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module…
CVE-2023-42670 - CVSS 6.5 (medium), 2023-11-03: A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC…
CVE-2023-5568 - CVSS 6.5 (medium), 2023-10-25: A heap-based Buffer Overflow flaw was discovered in Samba. It could allow a remote, authenticated attacker to exploit this vulnerability to cause a denial of…
CVE-2023-34967 - CVSS 5.3 (medium), 2023-07-20: A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is…
CVE-2023-34966 - CVSS 7.5 (high), 2023-07-20: An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core…
CVE-2023-3347 - CVSS 5.9 (medium), 2023-07-20: A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required"…
CVE-2022-2127 - CVSS 5.9 (medium), 2023-07-20: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the…
CVE-2023-34968 - CVSS 5.3 (medium), 2023-07-20: A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and…
CVE-2022-2447 - CVSS 6.6 (medium), 2022-09-01: A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from…
CVE-2021-3670 - CVSS 6.5 (medium), 2022-08-23: MaxQueryDuration not honoured in Samba AD DC LDAP
CVE-2022-26148 - CVSS 9.8 (critical), 2022-03-21: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When…
CVE-2021-44141 - CVSS 4.3 (medium), 2022-02-21: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the…
CVE-2020-14318 - CVSS 4.3 (medium), 2020-12-03: A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and…
CVE-2020-10730 - CVSS 6.5 (medium), 2020-07-07: A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4.…
CVE-2020-10685 - CVSS 5.5 (medium), 2020-05-11: A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible…
CVE-2019-14907 - CVSS 6.5 (medium), 2020-01-21: All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then…
CVE-2013-4280 - CVSS 5.5 (medium), 2019-11-04: Insecure temporary file vulnerability in RedHat vsdm 4.9.6.
CVE-2014-0224 - CVSS 7.4 (high), 2014-06-05: OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows…
CVE-2014-3470 - CVSS 4.3 (medium), 2014-06-05: The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher…
CVE-2014-0221 - CVSS 4.3 (medium), 2014-06-05: The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause…
CVE-2014-0160 - CVSS 7.5 (high), 2014-04-07: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to…
CVE-2012-4406 - CVSS 9.8 (critical), 2012-10-22: OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached,…
CVE-2012-0876 - CVSS 4.3 (medium), 2012-07-03: The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows…
CVE-2012-0037 - CVSS 6.5 (medium), 2012-06-17: Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products,…
CVE-2012-1938 - CVSS 9.3 (critical), 2012-06-05: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and SeaMonkey before 2.10 allow remote…
CVE-2012-1798 - CVSS 6.5 (medium), 2012-06-05: The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and…
CVE-2012-0260 - CVSS 6.5 (medium), 2012-06-05: The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a…
CVE-2012-0248 - CVSS 5.5 (medium), 2012-06-05: ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags…
CVE-2012-0247 - CVSS 8.8 (high), 2012-06-05: ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted…
CVE-2012-1823 - CVSS 9.8 (critical), 2012-05-11: sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that…
CVE-2011-3045 - CVSS 8.8 (high), 2012-03-22: Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other…
CVE-2012-0053 - CVSS 4.3 (medium), 2012-01-28: protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error…
CVE-2012-0031 - CVSS 4.6 (medium), 2012-01-18: scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have…