Denial Of Service(DoS)

Apache IoTDB is vulnerable to denial of service. The vulnerability exists in multiple functions due to untrusted patterns for REGEXP queries which allows an attacker to crash the application via malicious input. This vulnerability is only applicable to Java 8...

Non-Responsive Delegation Attack' (NRDelegation Attack)

unbound:edge is vulnerable to non-responsive delegation attack. The attacker can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside...

Privilege Escalation

github.com/grafana/grafana is vulnerable to cross-site scripting. The vulnerability exists in multiple functions of dashboardpermissions.go because viewer and editor permissions to dashboards and folders are not properly controlled with admin permissions which allows an attacker to gain access an...

Deserialization Of Untrusted Data

Apache Geode is vulnerable to deserialization of untrusted data. The vulnerability exists because the process-wide serialization filter is not properly configured when validate-serializable-objects is enabled which allows an attacker to inject and execute arbitrary code through the untrusted data...

Regular Expression Denial Of Service (ReDoS)

split-html-to-chars is vulnerable to regular expression denial of service. The vulnerability exists in Splitter function in index.js because the html inputs are not properly sanitized due to insufficient regular expression complexity applied when splitting html to letters for animation which allo...

Information Disclosure

Iintel-microcode is vulnerable to information disclosure. The vulnerability exists due to incomplete cleanup in specific special register read operations for some IntelR Processors which may allow an authenticated user to potentially enable information disclosure via local access...

Cross-domain Cookie Leakage

guzzlehttp/guzzle is vulnerable to cross-domain cookie leakage. The library does not check if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, which allows an attacker to set malicious domains and redirect the victim to harmful third party servers...

Server-side Request Forgery (SSRF)

Grafana is vulnerable to server-side request forgery. The vulnerability allows someone to bypass these security configurations if a malicious datasource running on an allowed host returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request...

Remote Code Execution (RCE)

redis is vulnerable to remote code execution. The vulnerability exists because the users are not properly restricted which allows an attacker with access to Redis can inject arbitrary Lua code...

Improper Access Control

github.com/golang/go is vulnerable to improper access control. A remote attacker is able to exploit the vulnerability by imposing as an actor who is supposed to be creating branches but not tags, then tricking the library to misinterpret branch names that falsely appear to be version tags...

Information Disclosure

Linux kernel is vulnerable to information disclosure. The vulnerability exists in net/ipv4/route.c due to the very small hash table, allowing an attacker to gain sensitive information through the IPv4 implementation...

Denial Of Service (DoS)

linux is vulnerable to denial of service. The vulnerability exists due to a memory leak in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c...

Denial Of Service (DoS)

rh-mysql80-mysql is vulnerable to denial of service. A high privileged attacker with network access via multiple protocols can compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL...

Information Disclosure

curl is vulnerable to information disclosure. The vulnerability exists in -t command line in CURLOPTTELNETOPTIONS because the option parser for sending NEWENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server which allows an attacker to...

Remote Code Execution (RCE)

chromium is vulnerable to remote code execution. The vulnerability is caused by insufficient validation of untrusted input in V8 for x8664, Googles high-performance JavaScript and WebAssembly engine that interprets code embedded in web pages...

Server-Side Request Forgery (SSRF)

netmask is vulnerable to server-side request forgery SSRF. The package is not able to differentiate private IP addresses as external IP addresses, and would allow an attacker to trick the application into parsing an IP address incorrectly. Successful exploitation of the vulnerability depends on h...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. An infinite loop in the e1000 NIC emulator occurs while processing transmit tx descriptors in processtxdesc when various descriptor fields are initialized with invalid values...

Server-Side Request Forgery (SSRF)

xstream is vulnerable to Server-Side Forgery Request. The processed stream at unmarshalling time contains information to recreate the formerly written objects, allowing an attacker to manipulate data streams referencing a resource in an intranet or the local host...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. The vulnerability exists due to a Heap Overflow was found in mwifiexsetwmmparams function of Marvell Wifi Driver which allows an attacker to crash the application via malicious input...

Remote Code Execution

struts2-core is vulnerable to remote code execution. Tag attributes can be used to perform a double evaluation when forced OGNL evaluation is applied, by using the %... syntax. This can lead to remote code execution when an attacker provides a malicious input to be evaluated...

Regular Expression Denial Of Service (ReDoS)

Handlebars is vulnerable to Regular Expression Denial of Service. The attacker is able to force the parser into an endless loop through maliciously crafted templates...

Denial Of Service

krb5is vulnerable to denial of service. The vulnerability exists because lib/krb5/asn.1/asn1encode.c support for indefinite length allows for an unbounded recursion...

Open Redirection

notebook is vulnerable to open redirection. An attacker may send a malicious link to a notebook server resulting in a redirection of users to third-party sites...

Denial Of Service (DoS)

linux is vulnerable to denial of service DoS. The vulnerability exists through a failure of the file system metadata validator in XFS, causing an inode with a valid, user-creatable extended attribute to be flagged as corrupt...

Denial Of Service (DoS)

linux is vulnerable to denial of service DoS. The vulnerability exists as the prbcalcretireblktmo function in net/packet/afpacket.c through parsing TPACKETV3...

Server-side Request Forgery (SSRF)

batik-svgrasterizer is vulnerable to server side request forgery SSRF. It is possible as it does not prevent an attacker to make malicious GET requests on behalf of the server through the use of xlink:hrefattributes which allows access to internal resources...

Information Disclosure

Kernel is vulnerable to information disclosure. The vulnerability exists due to incomplete Spectre-RSB mitigation which allows an attacker to gain access to sensitive information...

Information Disclosure

python is vulnerable to information disclosure. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address tha...

Denial Of Service (DoS)

apache apr is vulnerable to denial of service. It was found that the aprfnmatch function used an unconstrained recursion when processing patterns with the '' wildcard. An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Privilege Escalation

firefox is vulnerable to privilege escalation. The vulnerability exists when the Firebug add-on is in use. The XMLHttpRequestSpy module in the Firebug add-on exposes a Chrome privilege escalation flaw that could be used to execute arbitrary JavaScript with the privileges of the user running Firef...

Remote Code Execution (RCE)

Mozilla Firefox is vulnerable to Remote Code Execution RCE. Due to the flaws found in the processing of malformed web content, a page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Authentication Bypass

java is vulnerable to authentication bypass. A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or...

Privilege Escalation

kernel is vulnerable to privilege escalation. The vulnerability exists as a flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver which should otherwise be restricted to privileged users...

Information Disclosure

jboss-cli is vulnerable to information disclosure. The vulnerability exists as the JBoss EAP Vault system property security attribute value is revealed on CLI 'reload' command...

Denial Of Service (DoS)

Network Security Services NSS is vulnerable to denial of service DoS. It is possible due to out-of-bounds writes when passing an output buffer smaller than the block size to NSCEncryptUpdate...

Arbitrary File Overwrite

openssh is vulnerable to Arbitrary File Overwrite. Improper validation of object names allows a malicious server to overwrite files on the client-side via scp client...

Command Injection

nokogiri is vulnerable to command injection. The vulnerability exists as commands can be executed in a subprocess by Ruby's Kernel.open through Nokogiri::CSS::Tokenizerloadfile...

Deserialization Of Untrusted Object

jackson-databind is vulnerable to deserialization of untrusted object. The attack exists because it does not validate the gadget type before performing deserialization of polymorphic types with no limits...

Denial Of Service

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for ...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service DoS attacks. The vulnerability exists in the Linux kernel Virtualization Module CONFIGKVM for the Intel processor family CONFIGKVMINTEL when a guest was to flood the I/O port 0x80 with write requests leading to a crash in the host kernel...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...

Arbitrary Code Execution

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrar...

Cross-Site Scripting (XSS)

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. The following security issues are addressed with this release: An authorization flaw was discovered in Kubernetes; the API server did not...

Authentication Bypass

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws t...

Privilege Escalation

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain...

Remote Code Execution (RCE)

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...

Cross Site Scripting (XSS)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. It was found that the blkrqmapuseriov function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a...