Lucene search
+L
VeracodeMost viewed

38505 matches found

Veracode
Veracode
•added 2019/05/02 5:27 a.m.•51 views

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrar...

9.8CVSS9.1AI score0.46801EPSS
Exploits8References8Affected Software1
Veracode
Veracode
•added 2019/05/02 5:19 a.m.•51 views

Authentication Bypass

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws t...

10CVSS7.6AI score0.09991EPSS
Exploits0References36Affected Software5
Veracode
Veracode
•added 2019/05/02 5:3 a.m.•51 views

Improper Access Control

A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free using the kfree function arbitrary kernel memory...

7.2CVSS1.8AI score0.00489EPSS
Exploits0References21Affected Software1
Veracode
Veracode
•added 2019/05/02 4:43 a.m.•51 views

Access Restriction Bypass

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

10CVSS6AI score0.6477EPSS
Exploits7References11Affected Software204
Veracode
Veracode
•added 2019/01/15 9:20 a.m.•51 views

Remote Code Execution (RCE)

Jackson-databind is vulnerable to remote code execution RCE attacks. Attackers can exploit an incomplete fix of CVE-2017-7525 to bypass the blacklist when Spring libraries are available on the class path. In order to be vulnerable to this attack, either the use of @JsonTypeInfouse =...

9.8CVSS9.5AI score0.49727EPSS
Exploits7References25Affected Software101
Veracode
Veracode
•added 2019/01/15 9:20 a.m.•51 views

Use After Free

httpd24 is vulnerable to information disclosure attacks. The vulnerability exists as Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This...

7.5CVSS8.2AI score0.94651EPSS
Exploits9References84Affected Software15
Veracode
Veracode
•added 2019/01/15 9:17 a.m.•51 views

Security Manager Bypass

Jasper is vulnerable to Security Manager bypass. A tomcat utility method allows malicious web applications to access and bypass a configured Security Manager...

9.1CVSS8.9AI score0.10303EPSS
Exploits5References46Affected Software84
Veracode
Veracode
•added 2019/01/15 9:15 a.m.•51 views

Cross-site Scripting (XSS) Or Information Disclosure

Apache Tomcat is vulnerable to cross-site scripting XSS attacks and information disclosure. It permits invalid characters when parsing the HTTP request line. Attackers can exploit it, in conjunction with a proxy that also permits the invalid characters but with a different interpretation, to inje...

7.1CVSS6.5AI score0.39633EPSS
Exploits6References53Affected Software81
Veracode
Veracode
•added 2019/01/15 9:11 a.m.•51 views

Directory Information Disclosure

Tomcat is vulnerable to directory information disclosure. When accessing a directory protected by a security constraint with a URL that did not need in a slash, Tomcat would redirect to the URL with the trailing slash, confirming the presence of the file, even if no access is permitted...

5.3CVSS6.3AI score0.1838EPSS
Exploits0References63Affected Software5
Veracode
Veracode
•added 2019/01/15 8:58 a.m.•51 views

Denial Of Service (DoS)

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service infinite loop and CPU consumption via a crafted Content-Type header that bypasses a loop's intended exit conditions...

7.5CVSS7AI score0.83175EPSS
Exploits8References72Affected Software3
Veracode
Veracode
•added 2019/01/15 8:52 a.m.•51 views

Denial Of Service (DoS)

OpenSSL is susceptible to denial of service attack. During buffer reading and writing with the SSLMODERELEASEBUFFERS mode, TLS/SSL client or server using OpenSSL can crash while processing SSL/TLS due to the flaw in ssl3readbytes function in s3pkt.c in OpenSSL...

4CVSS7.2AI score0.34132EPSS
Exploits0References86Affected Software2
Veracode
Veracode
•added 2018/11/07 2:13 a.m.•51 views

Cross-site Scripting (XSS)

rack is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the data returned by the scheme method in Rack::Request, allowing XSS attacks...

6.1CVSS5.6AI score0.01882EPSS
Exploits0References8Affected Software1
Veracode
Veracode
•added 2018/01/15 6:4 a.m.•51 views

Denial Of Service (DoS)

undertow-core is vulnerable to denial of service DoS attacks. The application does not check if the HTTP header values it receives are null, allowing a malicious user to pass null header values to fill the heap and cause resource exhaustion...

7.5CVSS7.2AI score0.03022EPSS
Exploits0References14Affected Software131
Veracode
Veracode
•added 2017/07/26 1:24 a.m.•51 views

Remote Code Execution (RCE)

PHPMailer is vulnerable to remote code execution RCE attacks. A malicious user can inject and execute arbitrary code by passing extra parameters to the mail command. This is due to the improper interaction with the library's escapeshellarg function and internal escaping function performed in PHP...

9.8CVSS9.7AI score0.99714EPSS
Exploits59References17Affected Software1
Veracode
Veracode
•added 2017/02/16 1:56 a.m.•51 views

Directory Traversal

Apache Solr is vulnerable to directory traversal attacks. The vulnerability exists because a replication handler provided by Apache Solr supports an HTTP API which does not validate the user supplied filename parameter. Therefore, attackers can pull index files from a master/leader node using thi...

7.5CVSS8.3AI score0.06559EPSS
Exploits0References6Affected Software72
Veracode
Veracode
•added 2017/01/13 10:20 a.m.•51 views

Unsafe Encryption Scheme

bouncycastle unsafely uses an electronic code book ECB when using the Diffie-Hellman Integrated Encryption Scheme DHIES. ECB is known to be unsafe, particularly against replay attacks...

7.4CVSS7.5AI score0.02208EPSS
Exploits0References7Affected Software224
Veracode
Veracode
•added 2024/02/27 7:38 a.m.•50 views

Denial Of Service (DoS)

es5-ext is vulnerable to a Denial of Service DoS. The vulnerability is due to the handling of functions with very long names or complex default argument names in functioncopy or functiontoStringTokens, which may cause the script to stall. This potentially leads to Denial of Service DoS...

5.5CVSS6.6AI score0.00535EPSS
Exploits1References4Affected Software2
Veracode
Veracode
•added 2023/10/13 12:14 p.m.•50 views

Authorization Bypass

Org.apache.zookeeper: zookeeper is vulnerable to authorization bypass. This vulnerability exists due to improper implementation of a User-Controlled Key for user authentication, allowing an attacker to gain access to the system and perform unauthorized actions. Note that this vulnerability is onl...

9.1CVSS9.1AI score0.01713EPSS
Exploits0References9Affected Software1
Veracode
Veracode
•added 2023/10/13 9:29 a.m.•50 views

Arbitrary Code Execution

babel is vulnerable to Arbitrary Code Execution . An attacker can trick a user into compiling malicious code which can lead to code injection during compilation, when using specific plugins that rely on internal babel methods. This can lead to bypass of several protection mechanisms posed by the...

9.3CVSS7.7AI score0.0052EPSS
Exploits0References7Affected Software3
Veracode
Veracode
•added 2023/07/25 7:14 a.m.•50 views

Remote Code Execution (RCE)

nilsteampassnet/teampass is vulnerable to Remote Code Execution RCE. The vulnerability exists due to lack of restrictions of certain input fields which are directly inserted into a tp.config.php which allows an attacker to inject and execute malicious PHP code...

7.2CVSS7.6AI score0.01137EPSS
Exploits1References5Affected Software1
Veracode
Veracode
•added 2023/05/18 1:55 a.m.•50 views

Path Traversal

ghost is vulnerable to Path Traversal. The vulnerability exists because the static-theme.js does not properly sanitize file paths, which allows an attacker to access files outside the expected directory and read arbitrary files within the active theme's folder via relative paths such as...

7.5CVSS6.8AI score0.39078EPSS
Exploits3References3Affected Software1
Veracode
Veracode
•added 2023/05/12 6:8 p.m.•50 views

Improper Input Validation

OpenJDK is vulnerable to Improper Input Validation. An attacker can update, insert or delete access to some of Oracle Java SE and Oracle GraalVM Enterprise Edition accessible data through multiple protocols...

3.7CVSS6.4AI score0.01036EPSS
Exploits0References12Affected Software9
Veracode
Veracode
•added 2023/02/18 7:30 p.m.•50 views

Type Confusion

sequelize is vulnerable to Type Confusion. A remote attacker is able to inject malicious content due to improper parameter filtering, which results in type confusion, leading to code injection...

9.9CVSS8.5AI score0.00809EPSS
Exploits0References6Affected Software1
Veracode
Veracode
•added 2023/01/12 5:46 a.m.•50 views

Workload Injection

github.com/weaveworks/weave-gitops is vulnerable to workload injection. The library uses an S3 bucket for synchronising files, with no security controls to block unauthorised access in its endpoint, which allows local users on the same machine to see and alter the bucket content...

8.8CVSS6.6AI score0.00318EPSS
Exploits0References8Affected Software1
Veracode
Veracode
•added 2023/01/09 4:25 a.m.•50 views

Regular Expression Denial Of Service

luxon is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists via the replace parameter in regexParser.js, which does not properly handle user-untrusted data allowing the attacker to supply arbitrary input to the function, resulting in a system crash...

7.5CVSS7.5AI score0.01707EPSS
Exploits0References8Affected Software1
Veracode
Veracode
•added 2023/01/05 6:28 a.m.•50 views

Cross-site Scripting (XSS)

graphite-web is vulnerable to cross-site scripting. The vulnerability exists because the views.py does not properly escape the template name attribute before being rendered, allowing an attacker to inject and execute malicious JavaScript...

5.4CVSS5.4AI score0.00733EPSS
Exploits1References5Affected Software2
Veracode
Veracode
•added 2022/12/23 6:23 a.m.•50 views

Regular Expression Denial Of Service (ReDoS)

wheel is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the WHEELINFORE attribute in the init function of wheelfile.py, allowing an attacker to crash the application by passing a maliciously crafted Wheel file...

7.5CVSS7.3AI score0.02659EPSS
Exploits1References5Affected Software2
Veracode
Veracode
•added 2022/12/22 10:43 a.m.•50 views

Privilege Escalation

samba is vulnerable to Privilege Escalation. The vulnerability exists because the service account with the special constrained delegation permission could forge a more powerful ticket than the one it was presented with...

7.2CVSS7.1AI score0.04488EPSS
Exploits0References7Affected Software3
Veracode
Veracode
•added 2022/11/17 8:30 a.m.•50 views

Deserialization Of Untrusted Data

Apache Mina SSHD is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists in SimpleGeneratorHostKeyProvider.java due to using Java deserialization to load a serialized java.security.PrivateKey which allows an attacker to execute arbitrary code...

9.8CVSS9.3AI score0.03571EPSS
Exploits1References6Affected Software27
Veracode
Veracode
•added 2022/11/03 2:52 a.m.•50 views

Denial Of Service (DoS)

libtasn1.so is vulnerable to Denial Of Service DoS. The vulnerability exists in struct tagandclassst function of init.h due to an ETYPEOK off-by-one array size check which allows an attacker to crash the application via malicious input...

9.1CVSS8.7AI score0.02062EPSS
Exploits1References16Affected Software3
Veracode
Veracode
•added 2022/10/27 5:13 a.m.•50 views

Denial Of Service(DoS)

Apache IoTDB is vulnerable to denial of service. The vulnerability exists in multiple functions due to untrusted patterns for REGEXP queries which allows an attacker to crash the application via malicious input. This vulnerability is only applicable to Java 8...

7.5CVSS7.1AI score0.01341EPSS
Exploits0References5Affected Software3
Veracode
Veracode
•added 2022/10/17 1:29 a.m.•50 views

Denial Of Service (DoS)

golang.org/x/text is vulnerable to denial of service. The vulnerability exists in the ParseAcceptLanguage function of parse.go, allowing an attacker to cause an application crash through the maliciously crafted Accept-Language header...

7.5CVSS7.2AI score0.01428EPSS
Exploits0References10Affected Software6
Veracode
Veracode
•added 2022/09/30 3:42 a.m.•50 views

Remote Code Execution (RCE)

redshift-jdbc42 is vulnerable to remote code execution. The vulnerability exists because the verifyPeerName function of MakeSSL.java does not properly check the class type when instantiating an object from a class name, allowing an attacker to inject and execute malicious code through the object...

8.1CVSS8.3AI score0.01479EPSS
Exploits1References4Affected Software1
Veracode
Veracode
•added 2022/09/15 8:37 a.m.•50 views

Use-After-Free

libexpat.so is vulnerable to use-after-free. The vulnerability is possible because the raw names will be pointing into the stored entity value instead of the parse buffer in doContent method of the file xmlparse.c, which doesn't release the consumed memory...

8.1CVSS8.2AI score0.0176EPSS
Exploits0References18Affected Software8
Veracode
Veracode
•added 2022/08/02 6:52 p.m.•50 views

Denial Of Service (DoS)

go is vulnerable to Denial Of Service DoS. The vulnerability exists because of an index out of range in Float.GobDecode which allows a malicious user to cause an application crash...

7.5CVSS7.5AI score0.0199EPSS
Exploits1References11Affected Software19
Veracode
Veracode
•added 2022/07/23 9:31 a.m.•50 views

Cross-Site Scripting (XSS)

Best Practical Request Tracker is vulnerable to cross-site scripting. The vulnerability exists via a crafted content type for an attachment which allows an attacker to inject and execute arbitrary javascript...

6.1CVSS6.2AI score0.00727EPSS
Exploits0References4Affected Software2
Veracode
Veracode
•added 2022/06/16 5:10 p.m.•50 views

Double Free

linux is vulnerable to double free. The vulnerability exists due to a memory corruption in the mcbausbstartxmit in drivers/net/can/usb/mcbausb.c which allow an attacker to cause an application crash...

5.5CVSS6.6AI score0.00317EPSS
Exploits0References11Affected Software2
Veracode
Veracode
•added 2022/06/02 3:52 a.m.•50 views

Cross-site Scripting (XSS)

mautic/core is vulnerable to cross-site scriptingXSS attacks. Insufficient sanitizations for the user inputs in InstallService.php allow remote authenticated attackers to inject and execute malicious javascript...

7.6CVSS5.4AI score0.00436EPSS
Exploits0References3Affected Software1
Veracode
Veracode
•added 2022/05/26 4:37 a.m.•50 views

Cross-domain Cookie Leakage

guzzlehttp/guzzle is vulnerable to cross-domain cookie leakage. The library does not check if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, which allows an attacker to set malicious domains and redirect the victim to harmful third party servers...

8.1CVSS7.7AI score0.01266EPSS
Exploits0References6Affected Software2
Veracode
Veracode
•added 2022/05/14 8:53 p.m.•50 views

Denial Of Service (DoS)

linux is vulnerable to denial of service. The vulnerability exists in the drivers/usb/gadget/composite.c due to the lack of validation in the interface OS descriptor requests, allowing an attacker to cause an application crash...

4.6CVSS6.2AI score0.00927EPSS
Exploits0References11Affected Software2
Veracode
Veracode
•added 2022/05/14 8:52 p.m.•50 views

Out-of-bound Reads

linux kernel is vulnerable to out-of bound reads. The vulnerability exists in drivers/usb/gadget/legacy/inode.c due to mishandling in dev-buf release which allows an attacker to cause an application crash...

7.8CVSS7.2AI score0.00413EPSS
Exploits0References10Affected Software2
Veracode
Veracode
•added 2022/04/23 10:8 a.m.•50 views

Denial Of Service (DoS)

openjdk is vulnerable to denial of service attacks. The vulnerability exists in Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code which allows unauthenticated attacker with network access via multiple...

3.7CVSS3.9AI score0.02707EPSS
Exploits0References8Affected Software8
Veracode
Veracode
•added 2022/04/21 12:43 a.m.•50 views

Sandbox Bypass

Jenkins Pipeline is vulnerable to sandbox bypass. It uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library...

8.8CVSS3.9AI score0.01571EPSS
Exploits0References4Affected Software1
Veracode
Veracode
•added 2022/03/27 12:20 a.m.•50 views

Denial Of Service (DoS)

kernel is vulnerable to denial of service. The vulnerability exists due to a read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers...

7CVSS3.8AI score0.0031EPSS
Exploits0References9Affected Software3
Veracode
Veracode
•added 2022/03/22 12:35 a.m.•50 views

Remote Code Execution (RCE)

rh-dotnet is vulnerable to Remote Code Execution Vulnerability...

6.3CVSS2.9AI score0.01555EPSS
Exploits0References12Affected Software2
Veracode
Veracode
•added 2022/03/07 12:11 a.m.•50 views

Denial Of Service (DoS)

Chrome is vulnerable to denial of service. The vulnerability exists due to a Use after free in Views...

8.8CVSS2.3AI score0.00737EPSS
Exploits1References4Affected Software2
Veracode
Veracode
•added 2022/02/14 9:55 a.m.•50 views

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

6.5CVSS2AI score0.00572EPSS
Exploits1References3Affected Software1
Veracode
Veracode
•added 2022/01/26 4:33 a.m.•50 views

Information Disclosure

Linux kernel is vulnerable to information disclosure. The vulnerability exists in net/ipv4/route.c due to the very small hash table, allowing an attacker to gain sensitive information through the IPv4 implementation...

3.5CVSS1.1AI score0.00368EPSS
Exploits0References5Affected Software4
Veracode
Veracode
•added 2021/12/28 10:6 a.m.•50 views

Denial Of Service (DoS)

linux is vulnerable to denial of service. The vulnerability exists due to a memory leak in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c...

5.5CVSS2.9AI score0.00533EPSS
Exploits1References18Affected Software5
Veracode
Veracode
•added 2021/11/05 3:36 a.m.•50 views

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization which allows a Javascript alert dialog with arbitrary contents to be displayed over top an uncontrolled webpage...

4.3CVSS1.8AI score0.01622EPSS
Exploits0References11Affected Software7
Total number of security vulnerabilities5000