Lucene search
+L
VeracodeMost viewed

38505 matches found

Veracode
Veracode
added 2019/05/02 5:27 a.m.50 views

Path Traversal

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrar...

9.8CVSS9.1AI score0.46801EPSS
Exploits8References7Affected Software1
Veracode
Veracode
added 2019/05/02 5:27 a.m.50 views

Out-Of-Bounds Read

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

9.8CVSS8.2AI score0.30946EPSS
Exploits9References25Affected Software2
Veracode
Veracode
added 2019/05/02 5:21 a.m.50 views

Cross-Site Scripting (XSS)

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. The following security issues are addressed with this release: An authorization flaw was discovered in Kubernetes; the API server did not...

9.8CVSS8.6AI score0.86714EPSS
Exploits12References40Affected Software53
Veracode
Veracode
added 2019/05/02 5:12 a.m.50 views

Privilege Escalation

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain...

6.8CVSS4.7AI score0.04102EPSS
Exploits0References32Affected Software3
Veracode
Veracode
added 2019/05/02 4:46 a.m.50 views

Information Disclosure

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...

9.8CVSS6.5AI score0.98704EPSS
Exploits23References28Affected Software1
Veracode
Veracode
added 2019/01/15 9:17 a.m.50 views

Padding Oracle Attack

httpd is vulnerable to padding oracle attack. It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a...

7.5CVSS7.3AI score0.49024EPSS
Exploits4References46Affected Software4
Veracode
Veracode
added 2019/01/15 8:57 a.m.50 views

Denial Of Service (DoS)

httpd is vulnerable to denial of service DoS attacks. The vulnerability exists as the deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service resourc...

4.3CVSS4.2AI score0.37156EPSS
Exploits0References65Affected Software141
Veracode
Veracode
added 2017/05/08 11:13 a.m.50 views

Denial Of Service (DoS)

ImageMagick is vulnerable to denial of service DoS attacks. A malicious user can pass a bmp file to the system and cause a memory leak. This can lead to the system running out of memory and crashing...

6.5CVSS7.9AI score0.01502EPSS
Exploits0References4Affected Software1
Veracode
Veracode
added 2017/04/27 6:38 a.m.50 views

Blockwise Chosen-boundary Attacks

github.com/openshift/origin is vulnerable to blockwise chosen-boundary attacks aka the "BEAST" attack. It encrypts data by using CBC mode with chained initialization vectors which allows attackers to obtain plaintext HTTP headers through blockwise chosen-boundary attacks on HTTPS sessions. This...

6.9AI score0.73327EPSS
Exploits4
Veracode
Veracode
added 2017/02/10 2:44 a.m.50 views

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious Diffie-Hellman ServerKeyExchange message to the system to cause a segmentation fault that can lead to the system crashing...

5CVSS7.1AI score0.0498EPSS
Exploits0References16Affected Software3
Veracode
Veracode
added 2017/02/07 1:37 a.m.50 views

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS. A flaw in OpenSSL allows attackers to a double free to occur through DTLS packets...

5CVSS5.4AI score0.4334EPSS
Exploits0References52Affected Software1
Veracode
Veracode
added 2017/02/07 1:2 a.m.50 views

Denial Of Service (DoS) Through Null Pointer Dereference

OpenSSL is vulnerable to denial of service DoS attacks through a null pointer dereference. This can be triggered at remote DTLS servers by a handshake message where the ciphersuite is specified as a 1 anonymous DH or 2 anonymous ECDH ciphersuite...

4.3CVSS5.6AI score0.16946EPSS
Exploits0References56Affected Software1
Veracode
Veracode
added 2017/02/07 12:57 a.m.50 views

Man-in-the-Middle (MitM)

OpenSSL is vulnerable to man in the middle MitM attacks. These attacks are possible through the ssl23getclienthello function in s23srvr.c. It can be triggered by a ClientHello message fragment which forces OpenSSL to negotiate using the TLS 1.0 protocol insteadl of a higher, more secure version...

4.3CVSS5.1AI score0.13327EPSS
Exploits0References64Affected Software1
Veracode
Veracode
added 2017/02/01 8:53 a.m.50 views

Remote Code Execution (RCE)

ImageMagick is vulnerable to remote code execution RCE. The library does not sanitize certain user inputs, allowing a malicious user to pass a malicious image to the system for file conversion to trigger the execution of arbitrary code. This is also known as the ImageTragick vulnerability...

10CVSS8.7AI score0.97485EPSS
Exploits11References33Affected Software1
Veracode
Veracode
added 2026/05/15 9:28 p.m.49 views

Information Disclosure

Zabbix is vulnerable to an information disclosure. The vulnerability is due to the reuse of JavaScript Duktape contexts in Zabbix Server/Proxy, which allows a regular non-super administrator to leak sensitive data from hosts they are not authorized to access through shared global JavaScript...

7.1CVSS5.8AI score0.00154EPSS
Exploits0References3Affected Software1
Veracode
Veracode
added 2024/06/19 12:0 p.m.49 views

OS Command Injection

php81 is vulnerable to OS Command Injection. The vulnerability is due to misinterpretation of characters in the command line by the PHP CGI module when using certain code pages on Windows. This may allow a malicious user to pass options to the PHP binary, potentially revealing source code, runnin...

9.8CVSS9.6AI score0.99987EPSS
Exploits64References23Affected Software3
Veracode
Veracode
added 2024/03/29 6:54 a.m.49 views

Regular Expression Denial Of Service (ReDoS)

angular is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression backtracking in the ng-srcset directive. This potentially leads to Regular Expression Denial of Service ReDoS...

7.5CVSS6.6AI score0.01891EPSS
Exploits1References3Affected Software2
Veracode
Veracode
added 2024/03/27 10:22 a.m.49 views

Denial Of Service (DoS)

XNIO API is vulnerable to Denial of Service DoS. The vulnerability is caused due to the problematic accumulation of notifier states within the chain. When this chain grows to be excessively large, it can lead to a StackOverflowException, overwhelming the stack and potentially causing Denial of...

7.5CVSS7AI score0.03479EPSS
Exploits0References11Affected Software1
Veracode
Veracode
added 2023/12/27 7:38 p.m.49 views

SQL Injection (SQLi)

cacti:sid is a vulnerable of SQL Injection SQLi. The vulnerability due to receiving feature of SNMP Notification in the file ‘managers.php’. It leads to SQL Injection by allows the authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint...

8.8CVSS7.7AI score0.09022EPSS
Exploits1References4Affected Software1
Veracode
Veracode
added 2023/11/28 5:44 a.m.49 views

Denial Of Service (DoS)

phpseclib/phpseclib is vulnerable to Denial Of Service DoS. The vulnerability exists in the construct function of BinaryField.php. It does not properly limit the binary curves of degrees, allowing an attacker to cause an application crash by submitting binary finite fields with a degree larger th...

7.5CVSS6.9AI score0.00762EPSS
Exploits0References3Affected Software1
Veracode
Veracode
added 2023/10/30 6:23 a.m.49 views

Regular Expression Denial Of Service (ReDoS)

Django is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to the chars and words functions in text.py as there is no proper limiting or optimization while using regular expressions to parse and truncate input text. This allows an attacker to craft very long or...

7.5CVSS6.8AI score0.01225EPSS
Exploits0References11Affected Software2
Veracode
Veracode
added 2023/10/12 7:1 a.m.49 views

Integer Overflow

libX11.so is vulnerable to integer overflow. The vulnerability is due to insufficient validation checks within the XCreateImage function when calculating the image data size. This issue happen during the calculation of minbytesperline, which can potentially return a value that is too small for th...

7.8CVSS7.9AI score0.00461EPSS
Exploits1References8Affected Software2
Veracode
Veracode
added 2023/05/03 8:16 a.m.49 views

Cross-Site Scripting (XSS)

nunjucks is vulnerable to Cross-Site Scripting XSS. The vulnerability is caused by a bypass of the html autoescape functionality when there are two user controlled parameters on the same line of a template, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

6.1CVSS6.6AI score0.00354EPSS
Exploits0
Veracode
Veracode
added 2023/02/03 11:2 p.m.49 views

Out-of-bounds Write

kernel is vulnerable to Out-of-bounds Write. The vulnerability exists because the kernel debugger could be used to bypass UEFI Secure Boot restrictions. An attacker with access to a serial port could trigger the debugger and allow read and write access...

6.7CVSS6.9AI score0.00612EPSS
Exploits0References9Affected Software2
Veracode
Veracode
added 2022/12/11 9:38 a.m.49 views

Denial Of Service (DoS)

vim is vulnerable to denial of service. An attacker can crash the application through the heap-based buffer overflow by providing a maliciously crafted input to the skipwhite function of charset.c...

7.8CVSS7.9AI score0.00496EPSS
Exploits1References4Affected Software1
Veracode
Veracode
added 2022/12/11 2:24 a.m.49 views

Denial Of Service (DoS)

woodstox-core is vulnerable to Denial Of Service DoS. The vulnerability exists because the FullDTDReader.java does not properly limit the recursion limit for DTD parsing, allowing an attacker to cause an application crash through StackOverflow by passing a malicious input if DTD support is enable...

7.5CVSS7.5AI score0.19653EPSS
Exploits1References7Affected Software3
Veracode
Veracode
added 2022/12/02 5:22 p.m.49 views

Remote Code Execution (RCE)

SnakeYaml is vulnerable to Remote Code Execution RCE. The vulnerability is due to deserializing unrestricted types in the Constructor method leading to Remote Code execution through classpath injection...

9.8CVSS9.6AI score0.99615EPSS
Exploits10References14Affected Software6
Veracode
Veracode
added 2022/09/29 7:50 a.m.49 views

Path Traversal

twig/twig is vulnerable to path traversal. The vulnerability exists in findTemplate function of FilesystemLoader.php because the template loading directories are not properly configured which allows an attacker to load templates outside the configured directory...

7.5CVSS7.4AI score0.01557EPSS
Exploits0References18Affected Software2
Veracode
Veracode
added 2022/08/29 4:37 a.m.49 views

Privilege Escalation

librpm.so is vulnerable to privilege escalation. A local unauthenticated user who owns another ancestor directory is able to potentially gain root privileges of the system due to the lack of sanitizations in lib/fsm.c during symlink validations. This vulnerability exists due to incomplete fixes f...

7.8CVSS7.1AI score0.00481EPSS
Exploits1References6Affected Software2
Veracode
Veracode
added 2022/06/23 10:13 p.m.49 views

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists due to a flaw in hw, allowing an attacker to exploit the execution window of AMD LFENCE/JMP and expose sensitive information...

5.6CVSS1.6AI score0.00288EPSS
Exploits0References6Affected Software2
Veracode
Veracode
added 2022/06/22 12:42 p.m.49 views

Command Injection

openssl is vulnerable to command injection. The vulnerability exists in crehash script which allows an attacker to inject and execute malicious commands...

9.8CVSS9.6AI score0.96275EPSS
Exploits1References15Affected Software19
Veracode
Veracode
added 2022/06/15 6:49 a.m.49 views

Information Disclosure

notebook is vulnerable to information disclosure. Authenticated attackers are able to access sensitive files, when the server root directory's only protection from the server is being hidden. The issue is there because the requests directed through ContentsManager.allowhidden = False command only...

4.3CVSS4.8AI score0.0103EPSS
Exploits0References1Affected Software2
Veracode
Veracode
added 2022/06/14 4:42 p.m.49 views

Buffer Overflow

Apache HTTP Server is vulnerable to buffer overflow. The vulnerability exists due to a lack of sanitization of the return lengths to applications calling r:wsread that point past the end of the storage allocated for the buffer...

7.5CVSS8.7AI score0.04687EPSS
Exploits0References10Affected Software5
Veracode
Veracode
added 2022/06/02 10:49 p.m.49 views

Denial Of Service (DoS)

MariaDB is vulnerable to denial of service. The vulnerability exists due to a mishandling of a pushdown from a HAVING clause to a WHERE clause...

5.5CVSS2.8AI score0.00391EPSS
Exploits1References6Affected Software5
Veracode
Veracode
added 2022/05/23 3:36 a.m.49 views

Symlink Attack

github.com/argoproj/argo-cd is vulnerable to symlink attack. The vulnerability exists due to a lack of sufficient check if the application target directory contains plain Kubernetes YAML manifests allowing out-of-bound manifests and JSON files to leak from Argo CD repo-server...

4.3CVSS5.3AI score0.01074EPSS
Exploits0References4Affected Software1
Veracode
Veracode
added 2022/04/28 9:29 a.m.49 views

Information Disclosure

xen is vulnerable to Information Disclosure. The vulnerability exists due to a shared branch history in the Branch History Buffer BHB allowing an attacker to influence mispredicted branches...

5.6CVSS6.6AI score0.00495EPSS
Exploits0References6Affected Software2
Veracode
Veracode
added 2022/03/16 3:41 a.m.49 views

Information Disclosure

moodle/moodle is vulnerable to information exposure. The vulnerability exists due to a lack of sanitization in output field in the lib.php file, allowing to read sensitive information in the system...

4.3CVSS1.7AI score0.00726EPSS
Exploits0References2Affected Software1
Veracode
Veracode
added 2022/02/11 6:10 a.m.49 views

Remote Code Execution (RCE)

gnuplot is vulnerable to remote code execution.An attacker is able to exploit the vulnerability by injecting maliciously crafted script via shell metacharacters in Gnuplot commands...

9.8CVSS5.5AI score0.01776EPSS
Exploits0References4Affected Software1
Veracode
Veracode
added 2021/06/06 10:24 a.m.49 views

Denial Of Service (DoS)

linux is vulnerable to a memory leak in Linux kernel in llcpsockconnect...

7.5CVSS2.5AI score0.03259EPSS
Exploits0References12Affected Software4
Veracode
Veracode
added 2021/02/19 7:17 p.m.49 views

Remote Code Execution (RCE)

Mumble is vulnerable to remote code execution. The vulnerability exists when a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

8.8CVSS3.1AI score0.03203EPSS
Exploits0References6Affected Software5
Veracode
Veracode
added 2020/10/23 8:58 a.m.49 views

Authorization Bypass

OpenJDK is vulnerable to authorization bypass. The vulnerability exists through incomplete check for invalid characters in URI to path conversion...

3.7CVSS4.4AI score0.02196EPSS
Exploits0References8Affected Software5
Veracode
Veracode
added 2020/10/01 3:52 a.m.49 views

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service. The vulnerability exists because of an incorrect way of handling connection tracking functionality on ipv6 port 1720, allowing an attacker to cause an application crash through the out-of-bounds memory write...

8.1CVSS7.6AI score0.05114EPSS
Exploits1References9Affected Software2
Veracode
Veracode
added 2020/08/18 8:23 a.m.49 views

Information Disclosure

libvirt is vulnerable to information disclosure. A file descriptor for /dev/mapper/control is leaked into the QEMU process. This file descriptor allows for privileged operations to be made against device mapper on the host...

8.8CVSS2.1AI score0.00416EPSS
Exploits0References4Affected Software1
Veracode
Veracode
added 2020/07/22 3:54 a.m.49 views

Information Disclosure

kernel is vulnerable to information disclosure. A logic bug was found in the Linux kernels implementation of SSBD. A bug in the logic handling can allow an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in pla...

5.5CVSS1.5AI score0.00463EPSS
Exploits0References4Affected Software2
Veracode
Veracode
added 2020/04/10 1:3 a.m.49 views

Authorization Bypass

kernel is vulnerable to authorization bypass. In KVM Kernel-based Virtual Machine environments using raw format virtio disks backed by a partition or LVM volume, a privileged guest user could bypass intended restrictions and issue read and write requests and other SCSI commands on the host, and...

4.6CVSS1.1AI score0.00566EPSS
Exploits2References19Affected Software2
Veracode
Veracode
added 2020/04/10 12:35 a.m.49 views

Authentication Bypass

java is vulnerable to authentication bypass. A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or...

5CVSS2.1AI score0.06348EPSS
Exploits0References89Affected Software21
Veracode
Veracode
added 2019/10/24 7:13 a.m.49 views

XML External Entity (XXE)

Apache Poi is vulnerable to XML external entity XXE. During the use of XSSFExportToXml tool to convert user-provided Microsoft Excel documents, it is possible for an attacker to parse a malicious Microsoft Excel document containing a reference to an external entity and perform requests on behalf ...

5.5CVSS3.7AI score0.0099EPSS
Exploits0References19Affected Software1
Veracode
Veracode
added 2019/08/08 12:7 a.m.50 views

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists through a fix race condition between mmgetnotzero/gettaskmm and core dumping...

7CVSS2.9AI score0.00989EPSS
Exploits3References61Affected Software2
Veracode
Veracode
added 2019/07/25 7:17 a.m.49 views

Command Injection

github.com/moby/moby is vulnerable to Command Injection. Misintepretation of the git ref command as a flag allows an attacker to execute arbitrary code remotely if there is control over the build path issued to the docker build...

8.4CVSS8.2AI score0.02025EPSS
Exploits1References10Affected Software2
Veracode
Veracode
added 2019/05/16 1:48 a.m.49 views

Key Reinstallation Attack (KRACK)

WPA and WPA2 are vulnerable to key reinstallation attacks KRACK. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used group key GTK during a group key handshake...

5.3CVSS7AI score0.02285EPSS
Exploits0References44Affected Software3
Total number of security vulnerabilities5000