Arbitrary Code Execution

kernel-rt is vulnerable to arbitrary code execution. The vulnerability exists as it uses incorrect uid and gid values during credentials passing in the scmsetcred function...

Denial Of Service (DoS)

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: A heap-based buffer overflow flaw was found in the Linux kernel's iSCSI target subsystem. A remote attacker could use a specially-crafted iSCSI request to caus...

Improper Access Control

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...

Arbitrary Code Execution

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user...

Remote Code Execution (RCE)

Jackson-databind is vulnerable to remote code execution RCE attacks. Attackers can exploit an incomplete fix of CVE-2017-7525 to bypass the blacklist when Spring libraries are available on the class path. In order to be vulnerable to this attack, either the use of @JsonTypeInfouse =...

Use After Free

httpd24 is vulnerable to information disclosure attacks. The vulnerability exists as Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This...

Remote Code Execution (RCE) Through Deserialization

Jackson-databind is vulnerable to remote code execution RCE attacks. This is a follow-up similar attack of CVE-2017-7525. The attack is still possible because more dangerous classes were added in the later released versions and were not blacklisted...

Cross-site Scripting (XSS) Or Information Disclosure

Apache Tomcat is vulnerable to cross-site scripting XSS attacks and information disclosure. It permits invalid characters when parsing the HTTP request line. Attackers can exploit it, in conjunction with a proxy that also permits the invalid characters but with a different interpretation, to inje...

Denial Of Service (DoS) Memory Consumption, Arbitrary Code Execution And Object-injection Attacks

activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a...

Remote Code Execution (RCE)

Microsoft ChakraCore is vulnerable to remote code execution. This is due to a buffer over-read vulnerability which would allow a remote attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229,...

Timing Attack

openssl is vulnerable to Timing Attack. An attacker with access to mount a local timing attack during the ECDSA signature generation is able to exploit the vulnerability in the ECC scalar mmultiplication to recover the private key...

Cross-site Scripting (XSS)

rack is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the data returned by the scheme method in Rack::Request, allowing XSS attacks...

Remote Code Execution (RCE) Through File Inclusion

phpmyadmin is vulnerable to remote code execution RCE attacks. The application does not properly check page validity when they are loaded or redirected, allowing a malicious user to view and execute files on the server...

Cross-site Scripting (XSS)

bootstrap is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the data-container variable in tooltip.js, allowing a malicious user to inject and execute arbitrary Javascript...

Remote Code Execution (RCE)

drupal/core is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the lack of sanitization applied to URL endpoints where array objects can be supplied to request parameters, allowing a potential compromise of the PHP application, and even the underlying operating...

Denial Of Service (DoS)

undertow-core is vulnerable to denial of service DoS attacks. The application does not check if the HTTP header values it receives are null, allowing a malicious user to pass null header values to fill the heap and cause resource exhaustion...

Unsafe Number Generation

OpenSSL uses unsafe number generation. The library generates unsafe prime numbers, allowing a malicious user that can force a peer to perform multiple handshakes to conduct a man-in-the-middle attack...

Unsafe Encryption Scheme

bouncycastle unsafely uses an electronic code book ECB when using the Diffie-Hellman Integrated Encryption Scheme DHIES. ECB is known to be unsafe, particularly against replay attacks...

Denial Of Service (DoS)

jose is vulnerable to Denial Of Service DoS. This vulnerability is due to a flaw in the support for decompressing plaintext post-decryption. An attacker can exploit a scenario with exceptionally high compression ratios, leading to JWE token lengths falling below application-defined limits. This...

Denial Of Service (DoS)

es5-ext is vulnerable to a Denial of Service DoS. The vulnerability is due to the handling of functions with very long names or complex default argument names in functioncopy or functiontoStringTokens, which may cause the script to stall. This potentially leads to Denial of Service DoS...

Unrestricted File Upload

Apache Solr is vulnerable to Unrestricted File Upload. The vulnerability is due to the ConfigSets API accepting and uploading jar/class files without proper restriction of file type. When backing up Solr Collections, the configSet files will be saved to disk, but if the backup directory is includ...

Arbitrary Code Execution

babel is vulnerable to Arbitrary Code Execution . An attacker can trick a user into compiling malicious code which can lead to code injection during compilation, when using specific plugins that rely on internal babel methods. This can lead to bypass of several protection mechanisms posed by the...

Remote Code Execution (RCE)

nilsteampassnet/teampass is vulnerable to Remote Code Execution RCE. The vulnerability exists due to lack of restrictions of certain input fields which are directly inserted into a tp.config.php which allows an attacker to inject and execute malicious PHP code...

Prototype Pollution

tough-cookie is vulnerable to Prototype Pollution. The vulnerability exists due to improper domain sanitization when using the CookieJar with rejectPublicSuffixes=false which allows an attacker to modify the base prototype, resulting in Prototype Pollution...

Cross-Site Scripting (XSS)

nunjucks is vulnerable to Cross-Site Scripting XSS. The vulnerability is caused by a bypass of the html autoescape functionality when there are two user controlled parameters on the same line of a template, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Special Element Injection

curl is vulnerable to Special Element Injection. The library allows users to pass on user name and telnet options to the server without proper input scrubbing, allowing them to pass on content or do option negotiation without the application intending to do so...

Authentication Bypass

gradio is vulnerable to Authentication Bypass. The vulnerability exists due to the use of hard coded private ssh keys when sharing demos, which allows an attacker to gain access to other demos on the system...

Regular Expression Denial Of Service

luxon is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists via the replace parameter in regexParser.js, which does not properly handle user-untrusted data allowing the attacker to supply arbitrary input to the function, resulting in a system crash...

Regular Expression Denial Of Service (ReDoS)

wheel is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the WHEELINFORE attribute in the init function of wheelfile.py, allowing an attacker to crash the application by passing a maliciously crafted Wheel file...

Server-side Request Forgery (SSRF)

cxf-core is vulnerable to Server-side Request Forgery SSRF. The vulnerability exists due to the lack of URL encode in MTOM content-id, which allows an attacker to perform SSRF-style attacks on web services that take at least one parameter of any type through the href attribute of XOP:Include...

Denial Of Service (DoS)

woodstox-core is vulnerable to Denial Of Service DoS. The vulnerability exists because the FullDTDReader.java does not properly limit the recursion limit for DTD parsing, allowing an attacker to cause an application crash through StackOverflow by passing a malicious input if DTD support is enable...

HTTP Response Splitting

ruby is vulnerable to http response splitting. The vulnerability exists when applications use untrusted user input either to generate an HTTP response or to create a cgi cookie object...

Remote Code Execution (RCE)

redshift-jdbc42 is vulnerable to remote code execution. The vulnerability exists because the verifyPeerName function of MakeSSL.java does not properly check the class type when instantiating an object from a class name, allowing an attacker to inject and execute malicious code through the object...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. The vulnerability exists in fbcongetfont function in fbcon.c due to bound check failure allowing an attacker to crash the application by providing malicious input...

OS Command Injection

node is vulnerable to OS Command Injection. The vulnerability exists due to the insufficient sanitizations in IsIPAddress function of inspectorsocket.cc, which allows an attacker to gain control of the victim's router by performing DNS rebinding attacks via DBS requests...

Denial Of Service (DoS)

Envoy is vulnerable to denial of service. The vulnerability exists due to a segmentation fault in the GrpcHealthCheckerImpl allowing an attacker to crash the system by controlling an upstream host and also controlling the service discovery of that host via DNS, the EDS API, etc. and forcing the...

Double Free

linux is vulnerable to double free. The vulnerability exists due to a memory corruption in the mcbausbstartxmit in drivers/net/can/usb/mcbausb.c which allow an attacker to cause an application crash...

Information Disclosure

notebook is vulnerable to information disclosure. Authenticated attackers are able to access sensitive files, when the server root directory's only protection from the server is being hidden. The issue is there because the requests directed through ContentsManager.allowhidden = False command only...

Buffer Overflow

Apache HTTP Server is vulnerable to buffer overflow. The vulnerability exists due to a lack of sanitization of the return lengths to applications calling r:wsread that point past the end of the storage allocated for the buffer...

Timing Attack

firefox-esr is vulnerable to timing attack. An attacker allows to send a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals...

Symlink Attack

github.com/argoproj/argo-cd is vulnerable to symlink attack. The vulnerability exists due to a lack of sufficient check if the application target directory contains plain Kubernetes YAML manifests allowing out-of-bound manifests and JSON files to leak from Argo CD repo-server...

Denial Of Service (DoS)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. The vulnerability exists due to a read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers...

Remote Code Execution (RCE)

rh-dotnet is vulnerable to Remote Code Execution Vulnerability...

Denial Of Service (DoS)

Chrome is vulnerable to denial of service. The vulnerability exists due to a Use after free in Views...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Denial Of Service (DoS)

linux is vulnerable to denial of service. The vulnerability exists due to a memory leak in the ccprunaesgcmcmd function in drivers/crypto/ccp/ccp-ops.c...

Man-in-the-Middle (MitM)

postgresql is vulnerable to man-in-the-middle attacks. A man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first created when the server is configured to use trust authentication with a 'clientcert' requirement or to utilize 'cert' authentication...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. The vulnerability exists due to a use-after-free in drivers/infiniband/core/ucma.c...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists due to a lack of sanitization which allows a Javascript alert dialog with arbitrary contents to be displayed over top an uncontrolled webpage...