Lucene search
+L
RedhatcveMost viewed

211056 matches found

RedhatCVE
RedhatCVE
•added 2020/08/24 5:4 a.m.•64 views

CVE-2020-15810

A flaw was found in squid. Due to incorrect data validation, a HTTP Request Smuggling attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity. Mitigation Disable the relaxed HTTP parser in...

6.5CVSS3AI score0.02526EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2020/07/13 7:12 a.m.•64 views

CVE-2020-15104

An improper certificate validation vulnerability was found in envoyproxy/envoy, when externally created certificates with wildcards in the DNS Subject Alternative Name are used. This flaw allows an attacker to subvert the envoy filter or destination rules to access restricted resources. The highe...

5.5CVSS6.1AI score0.00252EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2020/04/09 12:20 p.m.•64 views

CVE-2018-5968

A deserialization flaw was discovered in the jackson-databind that could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaws CVE-2017-7525 and CVE-2017-17485 by...

9.8CVSS3.6AI score0.49727EPSS
SaveExploits7References1
RedhatCVE
RedhatCVE
•added 2020/03/23 8:1 p.m.•64 views

CVE-2020-9546

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

9.8CVSS3.5AI score0.04613EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2020/01/05 4:6 a.m.•64 views

CVE-2019-18805

A flaw was reported in the Linux kernel's TCP subsystem while calculating a packet round trip time, when a sysctl parameter /proc/sys/net/ipv4/tcpminrttwlen is set incorrectly. This causes an integer overflow which can lead to a denial Of service DOS attack. Mitigation This flaw can be mitigated ...

9.8CVSS2.9AI score0.03431EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2019/12/17 5:44 p.m.•64 views

CVE-2019-19332

An out-of-bounds memory write issue was found in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device could use this flaw to crash the system, resulti...

6.1CVSS1.5AI score0.00679EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
•added 2019/10/10 5:40 p.m.•64 views

CVE-2019-0192

A flaw was found in the Apache Solr's Config API, where it would permit the configuration of the JMX server via an HTTP POST request. An attacker could use this flaw to direct traffic to a malicious RMI server, and then trigger remote code execution or conduct further attacks. Mitigation Upgrade ...

9.8CVSS0.6AI score0.77508EPSS
SaveExploits1References2
RedhatCVE
RedhatCVE
•added 2019/08/23 4:52 a.m.•64 views

CVE-2019-9851

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers...

9.8CVSS1.8AI score0.78347EPSS
SaveExploits5References4
RedhatCVE
RedhatCVE
•added 2019/03/15 10:49 a.m.•64 views

CVE-2019-5420

A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit...

9.8CVSS4.1AI score0.92144EPSS
SaveExploits13References4
RedhatCVE
RedhatCVE
•added 2019/01/29 9:50 p.m.•64 views

CVE-2019-3774

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

9.8CVSS3.4AI score0.03032EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2017/11/08 10:20 a.m.•64 views

CVE-2017-16536

The cx231xxusbprobe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

7.2CVSS6.6AI score0.00382EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2017/11/08 10:20 a.m.•64 views

CVE-2017-16537

The imonprobe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

7.2CVSS6.6AI score0.00397EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
•added 2016/07/19 3:48 p.m.•64 views

CVE-2016-1000027

Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required...

9.8CVSS5.6AI score0.32257EPSS
SaveExploits4References2
RedhatCVE
RedhatCVE
•added 2016/06/29 12:18 p.m.•64 views

CVE-2016-5773

phpzip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free and application crash...

9.8CVSS7.9AI score0.0926EPSS
SaveExploits5References1
RedhatCVE
RedhatCVE
•added 2025/12/11 12:3 a.m.•63 views

CVE-2025-67502

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without an...

6.1CVSS6.5AI score0.00266EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
•added 2025/10/25 12:42 a.m.•63 views

CVE-2025-46185

An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and usernames...

6.2CVSS6.3AI score0.00129EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
•added 2025/08/17 3:24 p.m.•63 views

CVE-2025-55207

Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios prior to version 9.4.1. Astro 5.12.8 addressed CVE-2025-54793 where https://example.com//astro.build/press would redirect to the...

6.9CVSS7AI score0.00614EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2025/05/16 7:7 p.m.•63 views

CVE-2025-0133

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The...

6.9CVSS5.5AI score0.46401EPSS
SaveExploits8References3
RedhatCVE
RedhatCVE
•added 2025/03/23 3:20 p.m.•63 views

CVE-2025-29927

A flaw was found in Next.js package. This vulnerability allows bypassing authorization checks within a Next.js application if the authorization check occurs in middleware. Mitigation Block or drop external user requests which contain the x-middleware-subrequest header from reaching your Next.js...

9.1CVSS9AI score0.99278EPSS
SaveExploits58References5
RedhatCVE
RedhatCVE
•added 2025/03/14 7:56 p.m.•63 views

CVE-2025-2078

The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...

4.8CVSS5.7AI score0.00244EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2025/02/05 10:48 p.m.•63 views

CVE-2022-36970

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The...

7.8CVSS6.8AI score0.00652EPSS
SaveExploits0
RedhatCVE
RedhatCVE
•added 2024/04/17 1:0 p.m.•63 views

CVE-2023-6717

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

6CVSS5.5AI score0.00711EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2024/03/18 7:53 p.m.•63 views

CVE-2024-21661

A flaw was found in Argo CD that may result in a remote denial of service. The expireOldFailedAttempts function modifies an array while it is being iterated over. This issue may cause an application crash when executed in a multi-threaded environment if two threads interact with the same array...

7.5CVSS7.4AI score0.01176EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2024/03/04 9:32 a.m.•63 views

CVE-2024-27351

An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewordshtml filter of Django. This issue may allow an attacker to use a suitably crafted string to cause a denial of service...

7.5CVSS7AI score0.01854EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2024/02/07 7:29 a.m.•63 views

CVE-2024-1300

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading...

5.4CVSS5.7AI score0.01064EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2024/01/31 2:7 p.m.•63 views

CVE-2023-6780

An integer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message,...

5.3CVSS7.6AI score0.04794EPSS
SaveExploits8References5
RedhatCVE
RedhatCVE
•added 2023/12/28 6:30 a.m.•63 views

CVE-2023-51074

A stack overflow vulnerability was found in the Criteria.parse method in json-path. This issue occurs due to an uncontrolled recursion caused by specially crafted input, leading to a stack overflow. This vulnerability has the potential to trigger a crash, resulting in a denial of service...

5.3CVSS5.1AI score0.00676EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2023/12/06 9:47 a.m.•63 views

CVE-2023-46218

A flaw was found in curl that verifies a given cookie domain against the Public Suffix List. This issue could allow a malicious HTTP server to set "super cookies" in curl that are passed back to more origins than what is otherwise allowed or possible...

5.3CVSS6.2AI score0.01685EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2023/09/30 5:54 p.m.•63 views

CVE-2023-42116

The vulnerability was found in Exim within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the...

8.1CVSS6.6AI score0.03158EPSS
SaveExploits2References3
RedhatCVE
RedhatCVE
•added 2023/09/13 6:54 a.m.•63 views

CVE-2023-39318

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in...

6.1CVSS7.8AI score0.00815EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
•added 2023/08/09 7:48 a.m.•63 views

CVE-2023-34319

A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service DoS of the host by sending network packets to the backend, causing the backend to crash...

5.5CVSS6.7AI score0.00291EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2023/07/25 8:51 a.m.•63 views

CVE-2023-37903

A flaw was found in the vm2 custom inspect function, which allows attackers to escape the sandbox. This flaw allows attackers to run arbitrary code. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

9.8CVSS6.3AI score0.04215EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2023/07/20 1:37 p.m.•63 views

CVE-2023-3812

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious too big networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. Mitigati...

7.8CVSS7.5AI score0.00344EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2023/05/24 6:10 a.m.•63 views

CVE-2023-32697

A flaw was found in SQLite-JDBC. A vulnerability found JDBC URL allowed a malicious user to cause Remote Code Execution RCE...

8.8CVSS7.3AI score0.01592EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2023/05/19 4:10 a.m.•63 views

CVE-2023-31655

A vulnerability was found in the Redis package. This security flaw causes a segmentation violation in redisraft.c. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deploymen...

7.5CVSS7.1AI score0.01028EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2023/05/08 4:21 p.m.•63 views

CVE-2023-2156

A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition...

7.5CVSS6AI score0.06127EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2023/03/20 11:13 a.m.•63 views

CVE-2022-4900

A vulnerability was found in PHP where setting the environment variable PHPCLISERVERWORKERS to a large value leads to a heap buffer overflow...

6.2CVSS6.5AI score0.00367EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2023/03/14 10:43 a.m.•63 views

CVE-2023-28328

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of...

5.5CVSS5.9AI score0.00224EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2023/02/22 4:59 a.m.•63 views

CVE-2022-23713

A Cross-site-scripting XSS vulnerability was found in the Vega Charts Kibana integration. This issue could allow arbitrary JavaScript to be executed in a victim’s browser...

6.1CVSS2.9AI score0.00795EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2023/02/06 5:26 a.m.•63 views

CVE-2022-23498

A flaw was found in the Grafana package. When data-source query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a data source where the caching is enabled can acquire another user’s session. Mitigation To mitigate the vulnerability,...

8.8CVSS3AI score0.01132EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/11/16 11:26 a.m.•63 views

CVE-2022-45411

The Mozilla Foundation Security Advisory describes this flaw as: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitiga...

6.1CVSS2.3AI score0.00575EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2022/10/14 7:28 p.m.•63 views

CVE-2022-3517

A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service ReDoS when calling the braceExpand function with specific arguments, resulting in a Denial of Service...

7.5CVSS4.3AI score0.01816EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/09/05 5:58 a.m.•63 views

CVE-2020-10735

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int"text", a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits float, decimal, int.frombytes, and int for binary bases 2, 4, 8, 16, and 32 are no...

7.5CVSS2.4AI score0.05768EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/08/04 11:40 a.m.•63 views

CVE-2022-21534

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

4.9CVSS1.8AI score0.016EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/07/07 4:12 p.m.•63 views

CVE-2022-1902

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...

8.8CVSS3.2AI score0.01177EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/07/04 5:6 a.m.•63 views

CVE-2022-34176

A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website...

5.4CVSS2.1AI score0.77481EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/06/07 2:29 a.m.•63 views

CVE-2022-30322

A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. Mitigation The fix...

8.6CVSS2AI score0.01405EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/21 12:19 a.m.•63 views

CVE-2017-2906

An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the...

8.8CVSS6.1AI score0.01841EPSS
SaveExploits2References1
RedhatCVE
RedhatCVE
•added 2022/05/20 11:14 p.m.•63 views

CVE-2022-30596

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk...

2.9AI score0.00875EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2022/05/18 10:42 p.m.•63 views

CVE-2022-1473

A memory leak flaw was found in OpenSSL, resulting in TLS servers and clients being halted by out-of-memory conditions, leading to a denial of service. An attacker needs to repeat actions continuously to trigger this vulnerability, resulting in a loss of application availability. Mitigation Red H...

7.5CVSS1.6AI score0.02524EPSS
SaveExploits0References4
Total number of security vulnerabilities5000