Quay

A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notification. This flaw allows an attacker to trick a user into performing a malicious action to impersonate the target user. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Published: 2021-05-27T13:50:39.000Z
Updated: 2024-08-04T16:25:43.224Z

A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository email notifications. This flaw allows an attacker to add email addresses they do not own to repository notifications.

Published: 2021-05-26T23:46:57.000Z
Updated: 2024-08-04T16:25:43.401Z

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace.

Published: 2020-08-11T13:42:26.000Z
Updated: 2024-08-04T12:39:36.208Z

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.

Published: 2021-03-18T18:04:18.000Z
Updated: 2024-08-04T19:19:18.613Z