Product:

Openshift

(Redhat)
Repositories • https://github.com/openshift/origin-server
• https://github.com/opencontainers/runc
• https://github.com/jenkinsci/jenkins
• https://github.com/libarchive/libarchive
• https://github.com/php/php-src
#Vulnerabilities 140
Date Id Summary Products Score Patch Annotated
2014-06-20 CVE-2014-3496 cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file. Openshift, Openshift_origin N/A
2014-10-15 CVE-2014-3681 Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Jenkins, Openshift N/A
2014-10-15 CVE-2014-3664 Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors. Jenkins, Openshift N/A
2014-10-16 CVE-2014-3661 Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake. Jenkins, Openshift N/A
2014-10-16 CVE-2014-3662 Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts. Jenkins, Openshift N/A
2014-10-16 CVE-2014-3663 Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors. Jenkins, Openshift N/A
2014-10-16 CVE-2014-3667 Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code. Jenkins, Openshift N/A
2014-10-16 CVE-2014-3680 Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM. Jenkins, Openshift N/A
2014-11-13 CVE-2014-3602 Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp. Openshift N/A
2014-11-13 CVE-2014-3674 Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors. Openshift N/A