38838 matches found
Directory Information Disclosure
Tomcat is vulnerable to directory information disclosure. When accessing a directory protected by a security constraint with a URL that did not need in a slash, Tomcat would redirect to the URL with the trailing slash, confirming the presence of the file, even if no access is permitted...
Timing Attack
openssl is vulnerable to Timing Attack. An attacker with access to mount a local timing attack during the ECDSA signature generation is able to exploit the vulnerability in the ECC scalar mmultiplication to recover the private key...
Request Smuggling
jetty is vulnerable to request smuggling. An integer overflow in the chunk length parsing causes a large chunk size to be interpreted as a smaller chunk size. As a result, the content in the chunk body is interpreted as a pipelined request which can be exploited by an attacker to bypass...
HTTP Smuggling
undertow is vulnerable to HTTP Smuggling attacks. The library does not verify that messages do not contain invalid headers, allowing a malicious user to conduct http smuggling that can lead to cross-site scripting attacks...
Remote Code Execution (RCE)
jackson-databind is vulnerable to remote code execution RCE attacks. Attackers can exploit an incomplete fix of CVE-2017-7525 and CVE-2017-17485 to bypass the blacklist during Jackson deserialization. In order to be vulnerable to this attack, either the use of @JsonTypeInfouse =...
Denial Of Service (DoS) Through Infinite Loop
Expat is vulnerable to denial of service DoS attacks. A malicious user can cause the parser to enter an infinite loop by passing an XML document with in it...
Denial Of Service (DoS) Through Null Pointer Dereference
OpenSSL is vulnerable to denial of service DoS attacks through a null pointer dereference. This can be triggered at remote DTLS servers by a handshake message where the ciphersuite is specified as a 1 anonymous DH or 2 anonymous ECDH ciphersuite...
Server Side Request Forgery (SSRF)
ip is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to some IP addresses being improperly categorized via the isPublic, isPrivate, and isLoopback methods, which allows an attacker to perform Server-Side Request Forgery SSRF if an application utilizes the library to...
Cookie Mixed Case PSL Bypass
Curl is vulnerable to Cookie Mixed Case PSL Bypass. The vulnerability is caused due to a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List PSL. This allows a malicious HTTP server to set "super cookies" in curl that are passed back to more origi...
Integer Overflow
libX11.so is vulnerable to integer overflow. The vulnerability is due to insufficient validation checks within the XCreateImage function when calculating the image data size. This issue happen during the calculation of minbytesperline, which can potentially return a value that is too small for th...
Heap Buffer Overflow
curl is vulnerable to Heap Buffer Overflow. The vulnerability is due to the SOCKS5 proxy handshake. If the hostname is longer then 255 bytes, curl switches to local name resolution, and passes the resolved address to the proxy. If the SOCKS5 handshake is slow, the long hostname is directly copied...
Arbitrary Code Execution
langchain is vulnerable to Arbitrary Code Execution. The vulnerability exists in the frommathprompt function at langchain.chains.PALChain which allows an attacker to execute arbitrary codes through prompt injection...
Improper Certificate Validation
curl is vulnerable to Improper Certificate Validation. The vulnerability allows matching of wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates and could result in accepting patterns that otherwise should be mismatched...
Timing Attack
github.com/ginuerzh/gost is vulnerable to Timing Attacks. The vulnerability exists because the Authenticate function of auth.go does not properly compare sensitive secrets such as passwords, tokens and API keys using constant-time comparison, which allows an attacker to guess a secret by observin...
Path Traversal
git is vulnerable to Path Traversal. In the windows port of Git, no localized messages are shipped with the installer. As a result, Git is expected not to localize messages at all, and skips the gettext initialization which could be exploited...
Denial Of Service (DoS)
Linux kernel is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the dmxdev.c in dvbdemuxopen and dvbdmxdevrelease, allowing an attacker to cause refcount races an application crashes...
Information Disclosure
curl is vulnerable to Information Disclosure. curls HSTS support allows the use of HTTPS instead of HTTP but the HSTS could fail when used subsequently on the same command line leading to Cleartext Transmission which allows an attacker to gain sensitive information of the system...
Information Disclosure
curl is vulnerable to Information Disclosure. curls HSTS support allows the use of HTTPS instead of HTTP but the HSTS could fail when used subsequently on the same command line leading to Cleartext Transmission which allows an attacker to gain access to sensitive information...
Improper Access Control
nodejs is vulnerable to Improper Access Control. A remote authenticated attacker is able to bypass security restrictions by sending a specially-crafted request using ICUDATA environment variable, An attacker could exploit this vulnerability to search and potentially load ICU data...
Denial Of Service (DoS)
Linux kernel is vulnerable to Denial Of Service DoS. The vulnerability exists through use after free in the networking code because the schsfb enqueue function used the socket buffer SKB cb field after the same SKB had been enqueued and freed into a child qdisc, allowing an attacker to cause an...
Regular Expression Denial Of Service (ReDoS)
wheel is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the WHEELINFORE attribute in the init function of wheelfile.py, allowing an attacker to crash the application by passing a maliciously crafted Wheel file...
Regular Expression Denial Of Service (ReDoS)
loofah is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the attrnode.value attribute in the scrubattributes function of scrub.rb, allowing an attacker to crash the application by providing malicious SVG attributes...
Buffer Overflow
OpenSSL is vulnerable to buffer overflow. The vulnerability exists due to incomplete X.509 certificate name constraint checking after successful chain signature verification. An attacker can add a malicious email address to the certificate to overflow an arbitrary number of bytes on the stack wit...
Insecure Cookie
PHP is vulnerable to Insecure Cookie. The vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...
CRLF Injection
undici is vulnerable to CRLF Injection. The vulnerability exists due to the lack of sanitization used in the request path url in the request class of request.js, allowing an attacker to inject and execute malicious request headers when that header contains the \r\n characters...
SQL Injection
prestashop/blockwishlist is vulnerable to SQL injection. The vulnerability exists in getProductsOrCount function in WishListProductSearchProvider.php because order by and order way statements are not properly validated which allows an attacker to inject SQL queries...
Information Disclosure
intel-microcode, sid is vulnerable to information disclosure. An incomplete cleanup in specific special register write operations for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...
Buffer Overflow
Apache HTTP Server is vulnerable to buffer overflow. The vulnerability exists due to a lack of sanitization of the return lengths to applications calling r:wsread that point past the end of the storage allocated for the buffer...
Denial Of Service (DoS)
Apache HTTP Server is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization allowing an attacker to crash the system via an out of bounds read in apstrcmpmatch when provided with an extremely large input buffer...
Denial Of Service (DoS)
org.apache.tika, tika is susceptible to denial of service. This vulnerability exists in the extractMetadata function in BPGParser.java due to invalid memory allocation which allows an attacker to crash the system via a crafted file...
Out-of-bound Reads
linux kernel is vulnerable to out-of bound reads. The vulnerability exists in drivers/usb/gadget/legacy/inode.c due to mishandling in dev-buf release which allows an attacker to cause an application crash...
Information Disclosure
xen is vulnerable to Information Disclosure. The vulnerability exists due to a shared branch history in the Branch History Buffer BHB allowing an attacker to influence mispredicted branches...
Denial Of Service (DoS)
kernel is vulnerable to denial of service. The vulnerability exists due to a read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers...
Remote Code Execution (RCE)
firefox is vulnerable to remote code execution. The vulnerability exists due to a lack of validation of the boundaries of same-origin policy, allowing an attacker to use XSL transform to serve a user an XSL with maliciously crafted javascript...
Denial Of Service (DoS)
qemu is vulnerable to Denial Of Service DoS. The vulnerability exists due to a heap buffer overflow was found in the floppy disk emulator of QEMU in fdctrltransferhandler in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system...
Use-After-Free
Linux kernel is vulnerable to use-after-free attacks. The vulnerability exists through inconsistency of drivers/tty/ttyio.c and drivers/tty/ttyjobctrl.c. An attacker could use this flaw to crash the system...
Denial Of Service (DoS)
puma is vulnerable to denial of service DoS. The vulnerability exists as it was possible to monopolize a thread if the client does not reset and keeps requesting. This CVE exists due to an incomplete fix for CVE-2019-16770...
Denial Of Service (DoS)
xen is vulnerable to denial of service. An out-of-memory occurs when an unbounded queue of single threaded events are received faster than the thread is able to handle...
Authorization Bypass
grafana is vulnerable to authorization bypass. The team sync HTTP API allows any authenticated user to add external groups to existing teams. This vulnearbilitycan be abused to grant a user team arbitrary permissions...
Remote Code Execution
velocity-engine-core is vulnerable to remote code execution. The Uberspector fails to prevent access to java.lang.ClassLoader methods and allows an attacker that is able to modify Template contents to execute arbitrary Java code or run arbitrary system commands with the same privileges as the...
Remote Code Execution (RCE)
tomcat9 is vulnerable to remote code execution RCE. The vulnerability exists through the incomplete fix for CVE-2020-9484, with a configuration edge case that was highly unlikely to be used...
Privilege Escalation
kernel is vulnerable to privilege escalation. The DAX hugepages not considered during mremap, allowing a local attacker to obtain higher privileges on the system...
Arbitrary Code Execution
kernel is vulnerable to arbitrary code execution. A heap-based buffer overflow in the mwifiexretwmmgetstatus function in drivers/net/wireless/marvell/mwifiex/wmm.c allows an attacker to execute arbitrary code on the system...
XML External Entity
dom4j is vulnerable to XML external entity attacks. The default SaxReader does not disable external DTDs and External Entities by default, allowing an attacker to access local or internal network resources, or perform requests on behalf of the server...
Denial Of Service (DoS)
glibc is vulnerable to denial of service. It was found that the glibc addmntent function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab mounted file systems table file. If such utilities had the setuid bit set, a local attacker could use th...
Information Disclosure
httpd is vulnerable to information disclosure. The vulnerability exists as it was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule...
Denial Of Service (DoS)
kernel is vulnerable to denial of service DoS. The vulnerability exists as a divide-by-zero flaw was found in the azxpositionok function in the driver for Intel High Definition Audio, snd-hda-intel. A local, unprivileged user could trigger this flaw to cause a kernel crash...
Information Disclosure
kernel is vulnerable to information disclosure. The vulnerability exists as the sockgetsockopt function in the Linux kernel did not properly initialize a data structure that can be directly returned to user-space when the getsockopt function is called with SOBSDCOMPAT optname set...
Denial Of Service (DoS)
kernel is vulnerable to denial of service. A deficiency in the clone system call when called with the CLONEPARENT flag permits the caller the parent process to indicate an arbitrary signal it wants to receive when its child process exits. This could lead to a denial of service of the parent proce...
Unauthorized Access
libreoffice allows unauthorized access to application functions. The remote resources protection module is not applied to bullet graphics, allowing any user to enable stealth mode to retrieve remote resources...