39635 matches found
Code Injection
spring-cloud-gateway is vulnerable to code injection. With Gateway Actuator endpoint setting enabled, an attacker is able to inject malicious code through the exposed actuator endpoint...
Email Spoofing
matrixsydent allows email spoofing. Sending arbitrary emails from the Sydent email address is not handled to block, allowing a malicious user to take control of the content of invitation emails...
Directory Traversal
jetty-deploy is vulnerable to directory traversal. The vulnerability exists through the WebAppProvider filter as it does not canonicalize files passed in from the scanner, allowing access to files outside of its working directory...
Arbitrary Code Execution
dnsmasq is vulnerable to arbitrary code execution. A buffer overflow in the rfc1035.c:extractname function allows an attacker to execute arbitrary code on the host OS...
Out Of Bound Writes (OOB)
kernel-rt is vulnerable to out of bound writes attacks. A user or process able to access the /dev/kvm device could use this flaw to crash the system, resulting in a denial of service...
Unauthenticated Access
oracle java SE is vulnerable to unauthenticated access vulnerability. This exists due to not validating the length of the object identifier read from the DER input in Libraries component of OpenJDK before allocating memory to store the OID. An attacker able to make a Java application decode a...
Out-Of-Bounds Read
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...
Arbitrary Code Execution
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
AIOHTTP Leaks Cookie And Proxy-Authorization Headers On Cross-origin Redirect
Summary When following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. Impact The Cookie and Proxy-Authorizations headers could contain sensitive information which may be leaked to an unintended party after following...
Authentication Bypass
Apache Tomcat is vulnerable to Authentication Bypass. The vulnerability is due to improper validation between the TLS SNI hostname and the HTTP Host header, allowing a client to send mismatched hostnames and bypass client certificate authentication in configurations with multiple virtual hosts...
Session Fixation
Jenkins Bitbucket OAuth Plugin is vulnerable to session fixation. The vulnerability is due to the plugin not invalidating the previous session on login, where an attacker can reuse an existing session and gain unauthorized access...
Reverse Tabnabbing Attacks
jupyterlab is vulnerable to Reverse Tabnabbing attacks. The vulnerability is due to missing the noopener attribute in links generated by LaTeX typesetters in Markdown cells and files, which allows an attacker to exploit links with target=blank to potentially hijack the originating browser tab...
Regular Expression Denial Of Service (ReDoS)
Hugging Face Transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of a regex pattern /^/^// in the converttfweightnametoptweightname function, which allows attackers to craft malicious input strings causing catastrophic backtracking and...
Server-Side Request Forgery (SSRF)
langchain is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper restriction of requests in the Web Research Retriever component, allowing it to reach local addresses and enabling attackers to execute port scans, access local services, and potentially read instanc...
Regular Expression Denial Of Service (ReDoS)
fastapi is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to the python-multipart dependency which utilized a Regex expression with inefficient complexity. An attacker can inject a malicious Content-Type header, which causes the application to hang while it...
Path Traversal
org.apache.tiles: tiles-core is vulnerable to Path Traversal. The vulnerability is due to missing validation in the DefaultLocaleResolver.LOCALEKEY attribute set on the session while resolving XML definition files. This can lead to Server Side Request Forgery SSRF or XML External Entity Injection...
Cross-site Scripting (XSS)
vite is vulnerable to Cross-Site Scripting. This vulnerability exists because it does not properly sanitize inline scripts in the server.transformIndexHtml function, allowing an attacker to inject and execute malicious JavaScript into the browser. This vulnerability is only exploitable if the...
Unintended Leaks Of Proxy-Authorization Header
requests is vulnerable to Unintended Leaks Of Proxy-Authorization Header. The vulnerability exists in the rebuildproxies function of sessions.py when the credentials are supplied in the URL user information component such as https://username:password@proxy:8080, which allows an attacker to gain...
Server-side Request Forgery (SSRF)
directus is vulnerable to Server-side Request Forgery SSRF. The vulnerability exists when importing a file from a remote web server POST to /files/import, allowing an attacker to bypass the security controls that were implemented to patch the CVE-2022-23080 vulnerability by performing a DNS...
Denial Of Service (DoS)
Django is vulnerable to Denial Of Service DoS. The vulnerability exists because transreal.py caches the Accept-Language headers, allowing an attacker to cause an application crash via excessive memory usage if the value of the Accept-Language headers are very large...
Information Disclosure
opensearch is vulnerable to Information Disclosure. The vulnerability exists because the excluded fields are not correctly applied for specific queries in the Field-level security FLS with .keyword fields , allowing an attacker to gain read access to indexes through the restricted fields...
Shell Command Injection
imageprocessing is vulnerable to shell command injection. The apply function in chainable.rb does not properly check unsanitized user input operational commands, allowing an attacker to inject and execute malicious shell commands...
HTTP Request Smuggling
io.netty:netty-codec-http is vulnerable to HTTP request smuggling. Improper validation of control chars, when they are present at the beginning and/or end of the header name leads to HTTP request smuggling which allows an attacker to exploit other remote systems when these headers are used as a...
Cross-Site Scripting (XSS)
highcharts is vulnerable to cross-site scripting. The vulnerability exists because the chart options structure is not validated and sanitized when using useHTML flag, potentially allowing an attacker to inject and execute arbitrary Javascript in a user's browser...
Remote Code Execution (RCE)
redis is vulnerable to remote code execution. The vulnerability exists due to an integer overflow bug which could corrupt the memory heap...
Regular Expression Denial Of Service (ReDoS)
glob-parent is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists as the enclosure regex used to check for strings ending in enclosure containing path separator has an unescaped exclamation mark...
Remote Code Execution (RCE)
nukeviet/nukeviet is vulnerable to remote code execution. The vulnerability exists due to the lack of verification and sanitization of an untrusted nvloginhash cookie...
Denial Of Service (DoS)
php is vulnerable to denial of service DoS. The vulnerability exists as a bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL...
CRLF Injection
firefox is vulnerable to CRLF injection. A flaw was found in the way Firefox handled Location headers in redirect responses. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Firefox now treats two copies of the Location,...
Denial Of Service (DoS)
The JSON gem is vulnerable to denial of service. An attacker is able to create arbitrary objects in the target system using malicious JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects. This can potentially result in a denial of service condition. This...
HTTP Request Smuggling
netty-codec-http is vulnerable to HTTP request smuggling. The vulnerability exists as it improperly handles whitespaces in the Transfer-Encoding, and the Content-Length headers. This vulnerability is caused by an incomplete fix for CVE-2019-16869...
XML External Entities (XXE)
jackson-mapper-asl is vulnerable to XML external entity attacks. This vulnerability is similar to CVE-2016-3720 whereby the external DTD is not disabled, allowing an attacker to retrieve system files, or perform requests on behalf of the server using malicious XML documents...
Denial Of Service (DoS)
kernel is vulnerable to denial of service DoS. The vulnerability exists as vhostnet has an infinite loop while receiving packets leads to DoS...
Arbitrary File Write
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interprete...
Denial Of Service
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use thi...
Cross-site Request Forgery (CSRF)
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use thi...
Denial Of Service (DoS)
memcached is vulnerable to denial of service. The UDP support of the server allows spoofed traffic amplification denial of service. A remote attacker is able to exploit the vulnerability and crash the application via a network flood to UDP port 11211...
Time-of-check Time-of-use (TOCTOU) Race Condition
Apache Tomcat is vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. The vulnerability is due to a race condition during the creation of Unix domain sockets, which allows an unauthorized local attacker to exploit the timing window and gain access to the Unix domain socket...
Brute Force Attack
Yamcs Core is vulnerable to Brute Force Attack. The vulnerability is due to the absence of rate limiting, account lockout, and failed login throttling on the /auth/token endpoint, which allows an attacker to perform unlimited password-guessing attempts and conduct brute-force attacks against user...
Header Injection
aiohttp is vulnerable to Header Injection. The vulnerability is due to the C parser llhttp accepting null bytes and control characters in response header values, where crafted header values containing these characters can be interpreted differently by the application or downstream proxies,...
Remote Code Execution (RCE)
jenkins-core is vulnerable to Remote Code Execution. The vulnerability is due to unsafe deserialization of Java objects. This flaw allows attackers to execute arbitrary code via a crafted serialized Java object, which could trigger an LDAP query to a third-party server...
Race Condition
libcurl.so is vulnerable to a Race Condition. The library is susceptible to a TOCTOU race condition when it saves cookies, HSTS, and alt-svc data to a file. A victim might use the data for an intended purpose, but an attacker may overwrite the protected file...
Information Disclosure
umbracocms.identityextensions is vulnerable to Information Disclosure. A remote unauthenticated attacker is able to gain access to unauthorized endpoints because access tokens directly returns in the URL fragments, resulting in disclosure of sensitive information...
Denial Of Service (DoS)
php, Python, sha3 and pysha3 are vulnerable to Denial Of Service DoS. The vulnerability exists through the integer overflow and resultant buffer overflow in the sponge function interface due to the improper implementation of Keccak XKCP SHA-3 reference, allowing an attacker to crash the applicati...
Access Restriction Bypass
nginx is vulnerable to access restriction bypass. The vulnerability exists because TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates which allows an attacker to gain access to the system and perform unauthorized actions...
Prototype Pollution
async is vulnerable to prototype pollution. An attacker is able to inject malicious property types via mapValues method and gain unintended privileges due to prototype pollution vulnerability...
Denial Of Service (DoS)
linux is vulnerable to denial of service. The vulnerability exists due to a use-after-free exists in drivers/tee/teeshm.c in the TEE subsystem...
Deserialisation Of Untrusted Object
JMSSink in log4j is vulnerable to deserialization of untrusted object. The insecure use of JNDI in JMSSink allows an attacker to send malicious object in LDAP store if it is accessible by an attacker or is configured to use an untrusted site, leading to a remote code execution. Note: this...
Authorization Bypass
elgg/elgg is vulnerablbe to authorization bypass. The vulnerability exists through the user-controlled key, userguid allowing unauthorized access to remote attackers...