Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service DoS attacks. The vulnerability exists in the Linux kernel Virtualization Module CONFIGKVM for the Intel processor family CONFIGKVMINTEL when a guest was to flood the I/O port 0x80 with write requests leading to a crash in the host kernel...

Out-Of-Bounds Write

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...

Sandbox Restrictions Bypass

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Ja...

Improper Input Validation

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interprete...

Privilege Escalation

openssh is vulnerable to privilege escalation. A use-after-free flaw allows an attacker to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges...

Denial Of Service (DoS)

httpd is vulnerable to denial of service. A NULL pointer dereference flaw was found in the way the modcache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching...

Denial Of Service (DoS)

Quagga is a TCP/IP based routing software suite. The Quagga bgpd daemon implements the BGP Border Gateway Protocol routing protocol. The Quagga ospfd and ospf6d daemons implement the OSPF Open Shortest Path First routing protocol. A heap-based buffer overflow flaw was found in the way the bgpd...

Access Restriction Bypass

slf4j-ext is vulnerable to remote code execution RCE through access restriction bypass. Attackers can use data passed to the EventData class in order to bypass intended access restrictions, causing a deserialization vulnerability...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. A user-after-free UAF occurs in sysmqnotify due to the sock pointer not being set to NULL upon entry into the retry logic, allowing an attacker to cause a denial of service condition during a user-space close of a Netlink socket...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. It was found that the blkrqmapuseriov function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a...

Directory Information Disclosure

Tomcat is vulnerable to directory information disclosure. When accessing a directory protected by a security constraint with a URL that did not need in a slash, Tomcat would redirect to the URL with the trailing slash, confirming the presence of the file, even if no access is permitted...

Database-query Authentication Bypass

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

Request Smuggling

jetty is vulnerable to request smuggling. An integer overflow in the chunk length parsing causes a large chunk size to be interpreted as a smaller chunk size. As a result, the content in the chunk body is interpreted as a pipelined request which can be exploited by an attacker to bypass...

Remote Code Execution (RCE)

jackson-databind is vulnerable to remote code execution RCE attacks. Due to an incomplete fix for CVE-2017-7525, attackers can still send malicious code through JSON. The blacklist that was implemented, didn't take into account the c3p0 gadgets available in the classpath.In order to be vulnerable...

Information Disclosure

tomcat-coyote is vulnerable to information disclosure. The library contains a bug during the handling of pipelined requests when sending files. This can result in the response being sent for the wrong request. A malicious user can use this to allow the system to wrongly sent responses to them...

Cross-site Scripting

console-common is vulnerable to cross-site scripting XSS attacks. They are possible because it does not perform HTML escaping properly...

Denial Of Service (DoS) Through An Infinite Loop

OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible because it does not correctly handle ECParameter structures where the curve is over a malformed binary polynomial field. These attacks can be triggered through a session that uses an Elliptic Curve algorithm...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious Diffie-Hellman ServerKeyExchange message to the system to cause a segmentation fault that can lead to the system crashing...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious ASN.1 encoded RSA PSS certificate to the system that can cause a null pointer dereference that can lead to the system crashing...

Denial Of Service (DoS) Through Memory Consumption And Buffer Overflow

OpenSSL is vulnerable to denial of service DoS attacks and possible other attacks. These attacks are possible because the asn1d2ireadbio function doesn't correctly interpret integer data which can be leveraged to do buffer overflow attacks or cause memory consumption...

Remote Code Execution (RCE)

ImageMagick is vulnerable to remote code execution RCE. The library does not sanitize certain user inputs, allowing a malicious user to pass a malicious image to the system for file conversion to trigger the execution of arbitrary code. This is also known as the ImageTragick vulnerability...

HTTP Response Desynchronization

undici is vulnerable to HTTP Response Desynchronization. The vulnerability is due to improper Content-Length handling after retrying or resuming partial responses, where a stale length can be retained for a differently sized response body, potentially causing downstream response desynchronization...

Uncontrolled Resource Consumption (Infinite Loop)

pypdf is vulnerable to Uncontrolled Resource Consumption Infinite Loop. The vulnerability is due to improper handling of crafted PDF files containing threads/articles during the merge operation, which allows an attacker to trigger an infinite loop by supplying a malicious PDF, resulting in a...

Improper Access Control

Fission is vulnerable to improper access control. The vulnerability is due to the router automatically registering internal function routes without validating associated HTTPTrigger restrictions, which allows an attacker to invoke arbitrary functions directly by guessing the function name and...

Improper Authentication

github.com/QuantumNous/new-api is vulnerable to Improper Authentication. The vulnerability is due to insufficient validation of Stripe webhook events, which allows an attacker to forge webhook requests and fraudulently credit quota to an account without making a payment...

Prototype Pollution

LangSmith is vulnerable to Prototype Pollution. The vulnerability is due to an incomplete prototype pollution fix in its internally vendored lodash set utility, where the baseAssignValue function only guards against the proto key, but fails to prevent traversal via constructor.prototype, and...

Type Confusion

Handlebars is vulnerable to Type Confusion. The vulnerability is due to unsanitized handling of pre-parsed AST input in Handlebars.compile, which allows an attacker to inject malicious JavaScript via crafted AST nodes and execute arbitrary code...

Multipart Header Bypass

aiohttp is vulnerable to a Multipart Header Bypass. The vulnerability is due to insufficient size checks on multipart headers, where multipart headers are not subject to the same size restrictions as normal headers and an attacker can craft a response with an excessive number of multipart headers...

Memory Leakage

go-crypto-winnative is vulnerable to a Memory Leakage. The vulnerability is due to improper resource management due to failure to release the key handle in cng.TLS1PRF, causing a small memory leak on each call...

OS Command Injection

php81 is vulnerable to OS Command Injection. The vulnerability is due to misinterpretation of characters in the command line by the PHP CGI module when using certain code pages on Windows. This may allow a malicious user to pass options to the PHP binary, potentially revealing source code, runnin...

Username Enumeration

github.com/icewhaletech/casaos-userservice is vulnerable to Username Enumeration. The vulnerability is due to a disclosure of information in the application response with the error message 'User does not exist' or "Invalid password" providing a means for attackers to identify valid usernames,...

Denial Of Service (DoS)

es5-ext is vulnerable to a Denial of Service DoS. The vulnerability is due to the handling of functions with very long names or complex default argument names in functioncopy or functiontoStringTokens, which may cause the script to stall. This potentially leads to Denial of Service DoS...

Arbitrary Code Execution

Jetty-servlets is vulnerable to Arbitrary Code Execution. The vulnerability is due to insecure escaping of user input which can result in the execution of arbitrary commands. This vulnerability occurs in the CGI servlet handler through the getRuntime.exec method...

Business Logic Errors

github.com/answerdev/answer is vulnerable to Business Logic Errors. The vulnerability exists due to a lack of server side logic for account deletion, which allows an authenticated attacker to delete the administrator account...

Denial Of Service (DoS)

redis is vulnerable to Denial of Service DoS attacks. This vulnerability occurs when a replica sends a specially crafted message to the master. If the message is valid, the master could be tricked into entering an infinite loop. This could prevent the master from serving requests from other...

OS Command Injection

mlflow is vulnerable to OS Command Injection. The vulnerability exists in the cli due to lack of parameter checks which allows an attacker to inject and execute arbitrary commands...

Account Lockout

phpmyfaq is vulnerable to Account Lockout. A remote attacker is able to bypass the security mechanism due to improper input validation in the E-Mail field, which may lead to an account takeover or an account lockout without any possibility of recovery...

Improper Access Control

nodejs is vulnerable to Improper Access Control. A remote authenticated attacker is able to bypass security restrictions by sending a specially-crafted request using ICUDATA environment variable, An attacker could exploit this vulnerability to search and potentially load ICU data...

Authentication Bypass

github.com/kubevela/kubevela is vulnerable to authentication bypass. The vulnerability exists in authentication.go because the users are allowed use the platformID to re-generate the JWT tokens which allows an attacker to bypass the authentication...

Deserialization Of Untrusted Data

Apache Geode is vulnerable to deserialization of untrusted data. The vulnerability exists because the process-wide serialization filter is not properly configured when validate-serializable-objects is enabled which allows an attacker to inject and execute arbitrary code through the untrusted data...

Privilege Escalation

librpm.so is vulnerable to privilege escalation. A local unauthenticated user who owns another ancestor directory is able to potentially gain root privileges of the system due to the lack of sanitizations in lib/fsm.c during symlink validations. This vulnerability exists due to incomplete fixes f...

SQL Injection

prestashop/blockwishlist is vulnerable to SQL injection. The vulnerability exists in getProductsOrCount function in WishListProductSearchProvider.php because order by and order way statements are not properly validated which allows an attacker to inject SQL queries...

Denial Of Service (DoS)

Envoy is vulnerable to denial of service. The vulnerability exists due to a segmentation fault in the GrpcHealthCheckerImpl allowing an attacker to crash the system by controlling an upstream host and also controlling the service discovery of that host via DNS, the EDS API, etc. and forcing the...

Server-side Request Forgery (SSRF)

Grafana is vulnerable to server-side request forgery. The vulnerability allows someone to bypass these security configurations if a malicious datasource running on an allowed host returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request...

Remote Code Execution (RCE)

graphql-upload is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of file name via the upload function...

Authentication Bypass

curl is vulnerable to authentication bypass. The vulnerability exists because curl can reuse a previously created connection even when a TLS or SSH-related option is changed that should be prohibited to reuse...

Denial Of Service (DoS)

spring-messaging is vulnerable to denial of service. The vulnerability exists because the handleMessageInternal function of SimpleBrokerMessageHandler.java does not properly handle to ignore the invalid STOMP frames, allowing an attacker to cause an application crash through the WebSocket endpoin...

Cross-site Request Forgery (CSRF)

org.keycloak:keycloak-installed-adapter is vulnerable to cross-site request forgeryCSRF. A local attacker is able to cause denial of service conditions because OIDC logout endpoint does not have any CSRF protection configured...

Denial Of Service (DoS)

Spring Security OAuth is vulnerable to denial of service. The vulnerability exists due to a lack of restriction of the number of request initiating the Authorization Request for the Authorization Code Grant allowing an attacker to exhaust the system resources sending multiple requests with a sing...

Cross Site Scripting (XSS)

busybox is vulnerable to Cross Site Scripting XSS. The vulnerability exists due to arbitrary code execution which allows an attacker to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal...