CVE Feed

    Dashboard / CVE / CVE-2019-10205

    CVE-2019-10205

    A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.

    Published:Sep 18, 2019
    Last Modified:Nov 21, 2024
    EPS:Jan 2, 2020
    EPSS Score:0.00109
    CVSS Score:6.3

    Affected Products

    Vendor
    Redhat
    Product
    Quay

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-74244 (CVSS 5.9) — A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticate…
    CVE-2026-74243 (CVSS 6.5) — A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unaut…
    CVE-2026-74241 (CVSS 4.8) — A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handli…
    CVE-2026-74242 (CVSS 5.3) — A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notifica…
    CVE-2026-74245 (CVSS 5.9) — A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID cou…
    CVE-2026-74240 (CVSS 5.4) — A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sig…
    CVE-2026-74247 (CVSS 4.2) — A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can ex…
    CVE-2026-19730 (CVSS 4.2) — The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but …
    CVE-2026-19519 (CVSS 4.3) — A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an…
    CVE-2026-18255 (CVSS 7.2) — A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account token…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High