38838 matches found
Arbitrary Code Execution
jboss-seam2 is vulnerable to arbitrary code execution. The vulnerability exists as an input sanitization flaw was found in the way JBoss Seam processed certain parametrized JBoss Expression Language EL expressions. A remote attacker could use this flaw to execute arbitrary code via a URL,...
Information Disclosure
JBoss EAP is vulnerable to Information Disclosure. Authenticated users were able to access the status servlet, which could allow remote attackers to acquire details about deployed web contexts...
Denial Of Service (DoS)
The JSON gem is vulnerable to denial of service. An attacker is able to create arbitrary objects in the target system using malicious JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects. This can potentially result in a denial of service condition. This...
Remote Code Execution
jackson-databind is vulnerable to remote code execution. The vulnerability exists because it does not restrict the data sources for the org.apache.xbean.propertyeditor.JndiConverter object type, leading to deserialisation of arbitrary data from external untrusted sources which would allow an...
Remote Device Tracking
Kernel is using weak IP ID generation leads to remote device tracking...
Remote Code Execution (RCE)
jackson-databind is vulnerable to remote code execution RCE. The vulnerability exists as it does not stop classes from the p6spy package from being used as deserialization gadgets...
Buffer Overflows And Privilege Escalation
libguestfs-winsupport is vulnerable to heap-based buffer overflow. An attacker can run /bin/ntfs-3g with a malicious file, even causing local access escalation attack if the /bin/ntfs-3g is a setuid-root binary...
Information Disclosure
kernel is vulnerablbe to information disclosure. The vulnerability exists as fs/ext4/extents.c leads to information disclosure...
Denial Of Service (DoS)
kernel is vulnerable to denial of service DoS. The vulnerability exists through a use-after-free Read in vhosttransportsendpkt...
Use After Free
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: rh-php70-php 7.0.27. BZ1518843 Security Fixes: php: Heap overflow in mysqlnd when not receiving UNSIGNEDFLAG in BIT field CVE-2016-7412 php:...
Buffer Overflow
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php54 packages provide a recent stable release of PHP with the PEAR 1.9.4, APC 3.1.15, and memcache 3.0.8 PECL extensions, and a number of additional utilities. The php54 packages have been upgraded to...
Cross-site Request Forgery (CSRF)
Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use thi...
Sandbox Restrictions Bypass
IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...
Remote Code Execution (RCE)
BOSH Backup and Restore is vulnerable to remote code execution RCE. A remotely authenticated user is able to request extra backup files in a backup and restore job by modifying the metadata file, resulting in possible execution of arbitrary code...
Vulnerable Through Use Of C Library
Nokogiri is vulnerable to denial of service DoS attacks. These attacks are possible through the use and inclusion of the C library libxml2. This library is vulnerable to CVE-2016-4483. It might also be a duplicate of CVE-2016-3627...
Remote Code Execution (RCE)
flex-messenger-core is vulnerable to remote code execution RCE. The AMF3 deserializers in the library allows the instantiation of arbitrary classes via parameter-less java beans constructors. This allows a malicious user to send a malicious AMF3 object to the system to execute arbitrary code...
Denial Of Service (DoS)
ImageMagick is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious HDR file to the system to cause an infinite loop that can lead to the system running out of resources and crashing...
Denial Of Service (DoS) Through Null Pointer Dereference
OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass PKCS7 blob to the system to cause a null pointer dereference that can cause the system to crash...
HTTP Request Smuggling
puma is vulnerable to HTTP Request Smuggling. The vulnerability exists due to processing zero-length content-Length headers and chunked transfer encoding bodies in client.rb, allowing an attacker to smuggle HTTP requests...
Information Disclosure
postgresql is vulnerable to Information Disclosure. The vulnerability relates to a issue in function inlining where role specific policies can be executed other roles resulting in an incorrect policy which may permit a user to complete otherwise-forbidden reads and modifications...
Weak Encryption
TrustWalletCore contains Weak Encryption implementations. The vulnerability exists in mt19937 seed generation which has only 32 bits of entropy resulting in only 4 billion mnemonics which allows an attacker to brute force the private key...
OS Command Injection
hadoop-common is vulnerable to OS Command Injection. The vulnerability exists due to lack of sanitization of input file name by FileUtil.unTarFile, File API before being passed to the shell, allowing an attacker to pass malicious file name and inject arbitrary commands...
Remote Code Execution
font-converter is vulnerable to remote code execution. The vulnerability exists due to the missing sanitizations of user input passed to the exec function, which allows remote attackers to inject and execute malicious code...
Prototype Pollution
firefox is vulnerable to prototype pollution. The vulnerability exist in Top-Level Await implementation which causes a prototype pollution...
Denial Of Service (DoS)
openjdk is vulnerable to denial of service. The vulnerability exists due to a lack of validation of authentication allowing an attacker to crash the system using APIs in the specified Component...
Privilege Escalation
openjdk is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation of authorization allowing an attacker to gain unauthorized access to critical data or complete access to all Oracle Java SE...
Out-of-bounds Write
Linux kernel is vulnerable to Out-of-bounds Write attack. The vulnerability exist in hwatlutils.c file allows an attacker to trigger an out-of-bounds write via a crafted length value...
Denial Of Service (DoS)
linux is vulnerable to denial of service DoS attacks. A malicious user is able to cause heap overflow in legacy parameter, causing it to crash...
Side-channel Attack
kernel is vulnerable to side-channel attack. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory...
Information Disclosure
kernel is vulnerable to information disclosure. The vulnerability exists in the transparent inter-process communication functionality in net/tipc/crypto.c, allowing an attacker to exploit insufficient validation of user-supplied sizes for the MSGCRYPTO message type...
Remote Procedure Calls
linux kernel is vulnerable to remote procedure calls. The vulnerabilities exists due to fastrpcinternalinvoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages...
Remote Code Execution (RCE)
com.vaadin, flow-server is vulnerable to remote code execution. An attacker is able to inject malicious code into the frontend resources during application rebuilds...
Command Injection
lodash is vulnerable to Command Injection. The vulnerability exists through the unsanitized values of template...
Denial Of Service (DoS)
linux is vulnerable to denial of service.The vulnerability exists in the ccprunshacmd function in drivers/crypto/ccp/ccp-ops.c due to the memory consumption which allows an attacker to crash the application via malicious input...
Unauthorized Read
Openjdk 7 is vulnerable to unauthorised read. It is difficult to exploit vulnerability but it allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker...
EL Expression Injection
hibernate-validator is vulnerable to EL Expression Injection. The vulnerability exists as the value of modType in the validation message is improperly evaluated with $...
Arbitrary Code Execution
firefox is vulnerable to arbitrary code execution. The vulnerability exists as a web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...
Denial Of Service (DoS)
The kernel packages is vulnerable to Denial of Service DoS. It is due to instances of unsafe sprintf use were found in the Linux kernel Bluetooth implementation. Creating a large number of Bluetooth L2CAP, SCO, or RFCOMM sockets could result in arbitrary memory pages being overwritten. A local,...
Privilege Escalation
java is vulnerable to privilege escalation. An unspecified vulnerability allows an attacker to affect confidentiality, integrity and availability of the system via unknown vectors...
Arbitrary Code Execution
seamonkey is vulnerable to arbitrary code execution. The vulnerability exists as a webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey...
Denial Of Service (DoS)
OpenJDK is vulnerable to denial of service DoS. It is due to an incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl...
Information Disclosure
kernel is vulnerable to information disclosure. It can leak sensitive information from kernel stack memory via HIDPCONNADD command...
Authorization Bypass
commons-beanutils2 is vulnerable to authorization bypass. The vulnerability exists as the class property of Java objects are able to get access to the classloader by default...
CRLF Injection
Python is vulnerable to CRLF Injection. Remote unauthenticated attacker could exploit the flaw by controling a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that lacks a ? character followed by an HTTP header o...
Denial Of Service (DoS)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...
Out-Of-Bounds Write
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...
Denial Of Service (DoS)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exifthumbnail function to crash or, possibly, execute arbitrary code...
Use-After-Free
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
Stack-based Buffer Overflow
The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the Name Server Caching Daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. It was found that...
Denial Of Service (DoS)
tomcat-util is vulnerable to denial of service DoS attacks. The attack exists due to not proper handling of overflow in the decodeHasArray function in UTF-8 decoder...