38838 matches found
Denial Of Service (DoS)
QEMU is vulnerabel to denial of service. It causes a heap buffer overflow during packet reassembly...
Denial Of Service (DoS)
The kernel is vulnerable to denial of service. The attack exists because it causes heap-based buffer overflow in the function mwifiexuapparsetailies in drivers/net/wireless/marvell/mwifiex/ie.c, leading to a memory corruption and other consequences...
Arbitrary Code Execution
codehaus is vulnerable to arbitrary code execution. An incomplete fix for unsafe deserialization in jackson-databind allows an attacker to inject malicious objects and execute arbitrary code...
Man-in-the-Middle (MitM)
libcurl.so is vulnerable to man-in-the-middle attacks. The library recognizes a wildcard IP address in the subject's Common Name CN field of an X.509 certificate. This allows a remote attacker to spoof SSL servers using malicious certifacte issued by a legitimate CA and perform a man-in-the-middl...
Arbitrary Code Execution
httpd is vulnerable to arbitrary code execution. With MPM event, worker or prefork, code executing in less-privileged child processes or threads including scripts executed by an in-process scripting interpreter could execute arbitrary code with the privileges of the parent process usually root by...
Arbitrary Code Execution
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...
Denial Of Service (DoS)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...
Denial Of Service (DoS)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interprete...
Cross-Site Scripting (XSS)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php54 packages provide a recent stable release of PHP with the PEAR 1.9.4, APC 3.1.15, and memcache 3.0.8 PECL extensions, and a number of additional utilities. The php54 packages have been upgraded to...
Information Disclosure
IBM Java SE is vulnerable to information disclosure. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the...
Arbitrary Code Execution
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
Arbitrary Code Execution
java is vulnerable to arbitrary code execution. The vulnerability exists through Libraries...
Remote Code Execution (RCE)
kibana is vulnerable to arbitrary code execution attacks. The vulnerability exists in the Timelion visualizer when running unflatten, allowing an attacker to send a malicious request that will attempt to execute Javascript code, leading to arbitrary command execution on the host system...
Remote Code Execution (RCE)
kernel is vulnerable to remote code execution RCE attacks. The vulnerability exists as the Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of...
Denial Of Service (DoS)
Linux kernel is vulnerable to denial of service. A user-after-free UAF occurs in sysmqnotify due to the sock pointer not being set to NULL upon entry into the retry logic, allowing an attacker to cause a denial of service condition during a user-space close of a Netlink socket...
Use After Free
httpd24 is vulnerable to information disclosure attacks. The vulnerability exists as Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This...
Padding Oracle Attack
httpd is vulnerable to padding oracle attack. It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a...
Arbitrary Code Execution
nss-util is vulnerable to arbitrary code execution. A heap-based buffer overflow flaw was found in the way NSS parsed certain ASN.1 structures. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash, or execute arbitrary code,...
Denial Of Service (DoS) Memory Consumption, Arbitrary Code Execution And Object-injection Attacks
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a...
Remote Code Execution (RCE)
jackson-databind is vulnerable to remote code execution. The application does not block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization, which would allow a remote attacker to leverage this vulnerability to execute arbitrary code. This vulnerability is due to an...
Information Disclosure
tomcat-coyote is vulnerable to information disclosure. The library contains a bug during the handling of pipelined requests when sending files. This can result in the response being sent for the wrong request. A malicious user can use this to allow the system to wrongly sent responses to them...
Denial Of Service (DoS) Via Infinite Loop
tomcat-coyote is vulnerable to denial of service DoS attacks. The vulnerability is a result of backporting a fix for CVE-2016-6816 but not backporting the fix for the Tomcat bug 57544 which fails to handle an exceptional condition check for pos while processing HTTPS requests in the Apache Tomcat...
Denial Of Service (DoS)
OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious Diffie-Hellman ServerKeyExchange message to the system to cause a segmentation fault that can lead to the system crashing...
Denial Of Service (DoS)
OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious ASN.1 encoded RSA PSS certificate to the system that can cause a null pointer dereference that can lead to the system crashing...
Brute Force Decryption
OpenSSL is vulnerable to brute-force decryption attacks and RSA-to-EXPORTRSA downgrade attacks. These attacks are possible through the ssl3getkeyexchange function which offers a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue...
Man-in-the-Middle (MitM)
OpenSSL is vulnerable to man in the middle MitM attacks. These attacks are possible through the ssl23getclienthello function in s23srvr.c. It can be triggered by a ClientHello message fragment which forces OpenSSL to negotiate using the TLS 1.0 protocol insteadl of a higher, more secure version...
Denial Of Service (DoS) Through Memory Consumption
OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible because there is a memory leak in the tlsdecryptticket function which can be triggered through a session ticket...
Weak Cryptographic Protection Mechanisms
OpenSSL has weak cryptographic protection mechanism. The way that the BNsqr function in OpenSSL is implemented is incorrect. It doesn't not calculate the square of a BIGNUM value making it easier for attackers to get past the protection mechanism...
ECDHE-to-ECDH Downgrade Attacks
OpenSSL is vulnerable to ECDHE-to-ECDH downgrade attacks. This is due to a flaw in ssl3getkeyexchange which allows attackers to trigger a loss of forward secrecy to omitting the ServerKeyExchange message...
Remote Code Execution (RCE)
ImageMagick is vulnerable to remote code execution RCE. The library does not sanitize certain user inputs, allowing a malicious user to pass a malicious image to the system for file conversion to trigger the execution of arbitrary code. This is also known as the ImageTragick vulnerability...
Regular Expression Denial Of Service (ReDoS)
Wagtail is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression handling in the parsequerystring process for long query strings without spaces, allowing attackers to submit crafted queries that consume excessive server resources and...
OS Command Injection
php81 is vulnerable to OS Command Injection. The vulnerability is due to misinterpretation of characters in the command line by the PHP CGI module when using certain code pages on Windows. This may allow a malicious user to pass options to the PHP binary, potentially revealing source code, runnin...
Denial Of Service (DoS)
jose is vulnerable to Denial Of Service DoS. This vulnerability is due to a flaw in the support for decompressing plaintext post-decryption. An attacker can exploit a scenario with exceptionally high compression ratios, leading to JWE token lengths falling below application-defined limits. This...
Username Enumeration
github.com/icewhaletech/casaos-userservice is vulnerable to Username Enumeration. The vulnerability is due to a disclosure of information in the application response with the error message 'User does not exist' or "Invalid password" providing a means for attackers to identify valid usernames,...
Server Side Request Forgery (SSRF)
mpdf/mpdf is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to not sanitizing user input while creating PDF when using html2pdf service. An attacker can exploit this flaw to use crafted html to include any arbitrary URL in the input to read the data from or to attack the...
Unrestricted File Upload
Apache Solr is vulnerable to Unrestricted File Upload. The vulnerability is due to the ConfigSets API accepting and uploading jar/class files without proper restriction of file type. When backing up Solr Collections, the configSet files will be saved to disk, but if the backup directory is includ...
SQL Injection (SQLi)
cacti:sid is a vulnerable of SQL Injection SQLi. The vulnerability due to receiving feature of SNMP Notification in the file ‘managers.php’. It leads to SQL Injection by allows the authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint...
Missing Authorization Checks
matrixsynapse is vulnerable to Improper Authentication. The vulnerability is due to the completelogin function as It fails to verify the deactivated status of users during login. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the jwtconfig.enabled...
Remote Code Execution (RCE)
gitlab is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the lack of an authorization mechanism in the library, which allows an attacker to import maliciously crafted projects, injecting and executing malicious code...
Authentication Bypass
Grafana is vulnerable to authentication bypass vulnerability. The vulnerability is specififc to Grafana deployments configured to use Azure AD OAuth for user authentication with a multi-tenant Azure application and without restrictions on which user groups can authenticate via the 'allowedgroups'...
Improper Authorization
org.keycloak:keycloak-server-spi-private and org.keycloak:keycloak-services are vulnerable to Improper Authorization. The vulnerability exists under certain pre-conditions which allows an attacker to bypass authentication mechanisms via retrieving an access token for other OAuth clients, by using...
Improper Authorization
Symfony is vulnerable to Improper Authorization. The vulnerability exists in Store.php because the HTTP cache system stores all headers, which can potentially be stored and then subsequently returned to other clients, which would allow an attacker to retrieve the victim's session...
Arbitrary Code Execution
dompdf/dompdf is vulnerable to Arbitrary Code Execution. The vulnerability exists in Cache.php due to a lack of validations for SVG files in Dompdf and php-svg-lib, allowing an attacker to parse an arbitrary URL with arbitrary protocols, which can resulting in Arbitrary Code Execution...
Workload Injection
github.com/weaveworks/weave-gitops is vulnerable to workload injection. The library uses an S3 bucket for synchronising files, with no security controls to block unauthorised access in its endpoint, which allows local users on the same machine to see and alter the bucket content...
Cross-site Scripting (XSS)
graphite-web is vulnerable to cross-site scripting. The vulnerability exists because the views.py does not properly escape the template name attribute before being rendered, allowing an attacker to inject and execute malicious JavaScript...
Denial Of Service (DoS)
istio is vulnerable to denial of service. The vulnerability is due to the Kubernetes validating or mutating webhook service being exposed to the public, allowing a malicious attacker to send a specially crafted oversized message resulting in a crash to the control plane...
Information Leak
Linux Kernel is vulnerable to information leak. It is possible due to a flaw in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux kernel, allowing a local attacker with a special user privilege CAPSYSADMIN or CAPSYSRAWIO to create issues with confidentiality...
Denial Of Service (DoS)
curl is vulnerable to denial of service attacks. A malicious user is able to cause an application crash due to improper validation of syntactic correctness of the input, which makes the server return a 400 Bad Request response...
Denial Of Service (DoS)
go is vulnerable to Denial Of Service DoS. The vulnerability exists because of an index out of range in Float.GobDecode which allows a malicious user to cause an application crash...
Path Traversal
github.com/minio/minio is vulnerable to path traversal. The vulnerability exists in downloadReleaseURL function in update.go because the admin:ServiceUpdate is not properly handled which allows an attacker to get access to the file system...