Red Hat Quay 3.

Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable

• mirror registry for Red Hat OpenShift
• mirror registry for Red Hat OpenShift 2
• Server-side request forgery (SSRF)

Quay: repository auto-prune policy uuid idor in quay api

• Red Hat Quay 3
• Broken access control

Quay: build trigger uuid idor in quay api

• Red Hat Quay 3
• Broken access control

Quay: quay: global read-only superuser can access build trigger write credentials

• Red Hat Quay 3
• Broken access control

Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

• Red Hat Quay 3
• Cross-site scripting (XSS)

Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

• Red Hat Quay 3
• Cross-site scripting (XSS)

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

• Red Hat Quay 3
• CWE-1357

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Path traversal

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

• Red Hat Hardened Images
• Red Hat Ansible Automation Platform 2
• Path traversal

Quay: ssrf via build archive_url in quay build api

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Server-side request forgery (SSRF)

Quay: unauthenticated exported logs download in quay

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Authentication bypass

Quay: stripe webhook accepts forged events without signature verification in quay

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Weak cryptography or TLS

Quay: unauthenticated secscan notification endpoint in quay when psk is unset

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Authentication bypass

Quay: repository notification uuid idor in quay api

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Broken access control

Quay: ldap referral filter injection in quay external ldap authentication

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Other injection

Quay: jwt claim validation bypasses in quay federated robot and sso authentication

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Authentication bypass

Claircore: claircore: denial of service via unchecked type assertion in rpm header parser

• Red Hat Advanced Cluster Security 4
• Red Hat Quay 3
• Denial of service

Quay: ssrf in red hat quay notification webhooks (slack/generic)

• Red Hat OpenShift Update Service
• Red Hat Quay 3
• Server-side request forgery (SSRF)

Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser

• Red Hat Advanced Cluster Security 4
• Red Hat Quay 3
• Memory corruption

Quay: quay: stored xss via filedrop svg upload

• Red Hat Quay 3
• Cross-site scripting (XSS)

Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring

• Red Hat Quay 3
• CWE-598

Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints

• Red Hat Quay 3
• Server-side request forgery (SSRF)

Quay: red hat quay: authentication bypass allows privileged actions without valid credentials

• Red Hat Quay 3
• Authentication bypass

Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

• mirror registry for Red Hat OpenShift
• mirror registry for Red Hat OpenShift 2
• Open redirect

Quay: incorrect privilege assignment

• quay
• Red Hat Quay 3
• Privilege escalation

Quay: quay allows successful authentication with trucated version of the password

• Red Hat Quay 3
• CWE-305

Quay: unauthorized user may authenticate via oauth application token

• Red Hat Quay 3
• Authentication bypass

Quay: clickjacking on config-editor page severity

• Red Hat Quay 3
• CWE-1021

Quay: cross-site request forgery (csrf) on config-editor page

• Red Hat Quay 3
• Cross-site request forgery (CSRF)

Quay: stored cross site scripting

• Red Hat Quay 3
• Cross-site scripting (XSS)