DeutschShown in its original language — a full translation is planned for a future version.
Red Hat OpenShift: Mehrere Schwachstellen
view advisory published 2024-11-25
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen und einen Cross-Site-Scripting-Angriff durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-47875US | medium6.1 | Exploit | ||
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and… | ||||
| CVE-2024-21534US | — | Exploit | ||
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by… | ||||
| CVE-2024-48949US | critical9.1 | — | ||
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation. | ||||
| CVE-2024-45813US | — | — | ||
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad reg… | ||||
| CVE-2024-45296US | — | — | ||
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Bec… | ||||
| CVE-2024-34156US | — | — | ||
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. | ||||
| CVE-2024-29415US | — | Exploit | ||
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly cat… | ||||
| CVE-2023-42282US | critical9.8 | — | ||
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic. | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2024:10236 vom 2024-11-25external
- Red Hat Security Advisory RHSA-2024:10857 vom 2024-12-05external
- Red Hat Security Advisory RHSA-2024:10865 vom 2024-12-05external
- Red Hat Security Advisory RHSA-2024:11293 vom 2024-12-17external
- Red Hat Security Advisory RHSA-2025:0664 vom 2025-01-23external
- Red Hat Security Advisory RHSA-2026:1942 vom 2026-02-04external
- Red Hat Security Advisory RHSA-2026:2172 vom 2026-02-05external
- Atlassian Security Bulletin - November 18 2025external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan