Remote Code Execution (RCE)

php is vulnerable to remote code execution RCE attacks. The vulnerability exists as the asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which...

HTTP Smuggling

undertow is vulnerable to HTTP Smuggling attacks. The library does not verify that messages do not contain invalid headers, allowing a malicious user to conduct http smuggling that can lead to cross-site scripting attacks...

Directory Traversal

Apache Solr is vulnerable to directory traversal attacks. The vulnerability exists because a replication handler provided by Apache Solr supports an HTTP API which does not validate the user supplied filename parameter. Therefore, attackers can pull index files from a master/leader node using thi...

Denial Of Service (DoS) In SSL Alert Handling

OpenSSL is vulnerable to denial of service in SSL alert handling aka SSL-Death-Alert. The attacks are possible due to a flaw in the way SSL3ALWARNING are handled, consuming 100% CPU on the server...

Authorization Bypass

9router is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization handling in the Administrative API endpoint /api, which allows an attacker to bypass access controls and perform unauthorized actions remotely...

Path Traversal

org.openmrs.web, openmrs-web is vulnerable to Path Traversal. The vulnerability is due to improper path boundary validation in the /openmrs/moduleResources/moduleid endpoint, where user-controlled input is concatenated into filesystem paths without normalization or restriction checks, which allow...

Denial Of Service (DoS)

aiohttp is vulnerable to a Denial of Service DoS. The vulnerability is due to improper handling of POST request bodies when assert statements are bypassed under optimized execution, which allows an attacker to trigger an infinite loop using a specially crafted request and cause a denial of servic...

Regular Expression Denial Of Service (ReDoS)

transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of a vulnerable regular expression pattern config\..\.json in the getconfigurationfile function within the transformers.configurationutils module, which allows an attacker to craft...

Regular Expression Denial Of Service (ReDoS)

transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to a flawed regular expression pattern used in the getimports function to filter try/except blocks, which allows an attacker to craft input strings that cause catastrophic backtracking...

Credential Leakage

org.keycloak, keycloak-core is vulnerable to Credential Leakage. The vulnerability is due to a lack of proper validation and enforcement when administrators change the LDAP Connection URL without requiring re-entry of the currently configured LDAP bind credentials. The vulnerability allows an...

Server Side Request Forgery (SSRF)

mpdf/mpdf is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to not sanitizing user input while creating PDF when using html2pdf service. An attacker can exploit this flaw to use crafted html to include any arbitrary URL in the input to read the data from or to attack the...

Unrestricted File Upload

Apache Solr is vulnerable to Unrestricted File Upload. The vulnerability is due to the ConfigSets API accepting and uploading jar/class files without proper restriction of file type. When backing up Solr Collections, the configSet files will be saved to disk, but if the backup directory is includ...

Cookie Mixed Case PSL Bypass

Curl is vulnerable to Cookie Mixed Case PSL Bypass. The vulnerability is caused due to a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List PSL. This allows a malicious HTTP server to set "super cookies" in curl that are passed back to more origi...

Integer Overflow

libX11.so is vulnerable to integer overflow. The vulnerability is due to insufficient validation checks within the XCreateImage function when calculating the image data size. This issue happen during the calculation of minbytesperline, which can potentially return a value that is too small for th...

Improper Authorization

org.keycloak:keycloak-server-spi-private and org.keycloak:keycloak-services are vulnerable to Improper Authorization. The vulnerability exists under certain pre-conditions which allows an attacker to bypass authentication mechanisms via retrieving an access token for other OAuth clients, by using...

Timing Attack

github.com/ginuerzh/gost is vulnerable to Timing Attacks. The vulnerability exists because the Authenticate function of auth.go does not properly compare sensitive secrets such as passwords, tokens and API keys using constant-time comparison, which allows an attacker to guess a secret by observin...

Path Traversal

git is vulnerable to Path Traversal. In the windows port of Git, no localized messages are shipped with the installer. As a result, Git is expected not to localize messages at all, and skips the gettext initialization which could be exploited...

Cross-site Scripting (XSS)

graphite-web is vulnerable to cross-site scripting. The vulnerability exists because the updateTimeRange function of dashboard.js does not properly escape the Relative Time Range values before being rendered, allowing an attacker to inject and execute malicious javascript...

Server-Side Request Forgery

org.apache.xmlgraphics:batik-bridge is vulnerable to server-side request forgery. The vulnerability exists in DefaultExternalResourceSecurity because the constructor logic does not properly restrict external resources, which allows remote attackers to cause SSRF bypass and gain access to...

Non-Responsive Delegation Attack' (NRDelegation Attack)

unbound:edge is vulnerable to non-responsive delegation attack. The attacker can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside...

Privilege Escalation

github.com/grafana/grafana is vulnerable to cross-site scripting. The vulnerability exists in multiple functions of dashboardpermissions.go because viewer and editor permissions to dashboards and folders are not properly controlled with admin permissions which allows an attacker to gain access an...

Denial Of Service (DoS)

go is vulnerable to Denial Of Service DoS. The vulnerability exists because of an index out of range in Float.GobDecode which allows a malicious user to cause an application crash...

Denial Of Service (DoS)

org.springframework.security:spring-security-oauth2-client is vulnerable to denial of service DoS attacks. An attacker is able to cause resource exhaustion via sending multiple requests initiating the authorization request for the authorization code grant using a single session or multiple...

Double Free

linux is vulnerable to double free. The vulnerability exists due to a memory corruption in the mcbausbstartxmit in drivers/net/can/usb/mcbausb.c which allow an attacker to cause an application crash...

Denial Of Service (DoS)

Apache HTTP Server is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization allowing an attacker to crash the system via an out of bounds read in apstrcmpmatch when provided with an extremely large input buffer...

Cross-domain Cookie Leakage

guzzlehttp/guzzle is vulnerable to cross-domain cookie leakage. The library does not check if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, which allows an attacker to set malicious domains and redirect the victim to harmful third party servers...

Out-of-bound Reads

linux kernel is vulnerable to out-of bound reads. The vulnerability exists in drivers/usb/gadget/legacy/inode.c due to mishandling in dev-buf release which allows an attacker to cause an application crash...

Remote Code Execution (RCE)

redis is vulnerable to remote code execution. The vulnerability exists because the users are not properly restricted which allows an attacker with access to Redis can inject arbitrary Lua code...

Sandbox Bypass

Jenkins Pipeline is vulnerable to sandbox bypass. It uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library...

SQL Injection

django is vulnerable to SQL injection. The library directly passes the user input directly to the QuerySet.annotate, aggregate, and extra methods, allowing an attacker to inject malicious SQL query in column aliases via a malicious dictionary as the passed kwargs...

Use After Free

firefox is vulnerable to use after free. The vulnerability exists when a use-after-free could is triggered using a link with rel="localization" by destroying an object during JavaScript execution and then referencing the object through a freed pointer which causes an application crash...

Information Disclosure

phpmyadmin/phpmyadmin is vulnerable to information disclosure. An attacker can gain sensitive information through the lang parameter,pmaparameter, and the cookie section by providing malicious invalid requests...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists due to a browser stores files in the /tmp folder, which is accessible by all local users...

Authorization Bypass

url-parse is vulnerable to authorization bypass. The use of User-Controlled Key allows an attacker to transform original invalid URL into a valid one with url.pathname as host...

Denial Of Service (DoS)

linux is vulnerable to denial of service. The vulnerability exists due to a memory leak in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c...

Denial Of Service (DoS)

ntfs-3g:sid is vulnerable to denial of service. When a specially crafted NTFS inode pathname is supplied in an NTFS image, a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution...

Insecure Session ID

org.eclipse.jetty, jetty-server has Insecure Session ID. The vulnerability exists due the SessionListenersessionDestroyed not validating the session ID if an exception is thrown...

Information Disclosure

curl is vulnerable to information disclosure. The vulnerability exists in -t command line in CURLOPTTELNETOPTIONS because the option parser for sending NEWENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server which allows an attacker to...

Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. Maliciously crafted web content may violate iframe sandboxing policy. This issue was addressed with improved iframe sandbox enforcement...

Denial Of Service (DoS)

linux is vulnerable to denial of service DoS. The vulnerability exists through a memory leak if PERFEVENTIOCSETFILTER is used...

Man-in-the-Middle

postgresql is vulnerable to man-in-the-middle attack. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text...

Out-Of-Bounds Write

Linux kernel is vulnerable to an out-of-bounds write. Crafted keycode table in drivers/input/input.c enables the possibility of an attack...

Remote Code Execution (RCE)

kernel is vulnerable to remote code execution RCE. The vulnerability exists through a buffer over-write in vgaconscroll...

Arbitrary Code Execution

kernel is vulnerable to arbitrary code execution. A heap-based buffer overflow in the mwifiexretwmmgetstatus function in drivers/net/wireless/marvell/mwifiex/wmm.c allows an attacker to execute arbitrary code on the system...

Information Disclosure

python is vulnerable to information disclosure. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address tha...

Authorization Bypass

kernel is vulnerable to authorization bypass. In KVM Kernel-based Virtual Machine environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests and other SCSI commands on the host, and...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as the sockgetsockopt function in the Linux kernel did not properly initialize a data structure that can be directly returned to user-space when the getsockopt function is called with SOBSDCOMPAT optname set...

Unauthorized Access

libreoffice allows unauthorized access to application functions. The remote resources protection module is not applied to bullet graphics, allowing any user to enable stealth mode to retrieve remote resources...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists through a fix race condition between mmgetnotzero/gettaskmm and core dumping...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While processing SACK segments, the Linux kernel's socket buffer SKB data structure becomes fragmented. Each...