TCP Session Hijack

kernel-rt is vulnerable to TCP session hijack attacks. The vulnerability exists as net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack...

Protection Mechanism Bypass

OpenSSL is vulnerable to protection mechanism bypass. This is because OpenSSL accepts several variations of certificate signature algorithms and signature encodings. It doesn't then enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. This...

Cross-site Scripting (XSS)

notebook is vulnerable to a cross-site scripting XSS attack. The library does not properly sanitize URLs passed through a directory name, allowing a malicious user to inject and execute arbitrary Javascript...

Remote Code Execution (RCE)

jackson-databind is vulnerable to remote code execution RCE attacks. The vulnerability exists because it does not prevent the deserialization of certain gadget types from the JDBC driver which could be used to perform remote code execution attacks through deserialization...

Cross-site Scripting (XSS)

bootstrap is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the data-container variable in tooltip.js, allowing a malicious user to inject and execute arbitrary Javascript...

Cross-Site Request Forgery(CSRF)

Wordpress is vulnerable to cross-site request forgery CSRF attacks. The attacks can be launched because wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php have flaws, allowing the widget-access action requests to be hijacked by the attackers...

Information Disclosure

tomcat-coyote is vulnerable to information disclosure. The library contains a bug during the handling of pipelined requests when sending files. This can result in the response being sent for the wrong request. A malicious user can use this to allow the system to wrongly sent responses to them...

Unsafe Number Generation

OpenSSL uses unsafe number generation. The library generates unsafe prime numbers, allowing a malicious user that can force a peer to perform multiple handshakes to conduct a man-in-the-middle attack...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a long digit string in hex format to trigger an integer overflow, which can cause heap memory corruption or null pointer dereferences that can cause the system to crash...

Class Loader Manipulation With CookieInterceptor

Struts 2 Core is vulnerable to class loader manipulation vulnerability. The vulnerability exists because the getClass method does not properly restrict access to cookies as it accepts all cookie names when "\" is used to configure cookiesName parameter which allows remote attackers to manipulate...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams...

Improper Access Control

github.com/grafana/grafana is vulnerable to Improper Access Control. The vulnerability is caused by an improper authorization in the access control for plugin data sources protected by the ReqActions json field of the plugin.json. This authorization can be bypassed if the user or service account ...

Information Leak

pycryptodome and pycryptodomex are vulnerable to Information Leakage. The vulnerability is caused due to a side-channel leakage for OAEP decryption Optimal Asymmetric Encryption Padding used during RSA encryption. This can be exploited to mount a Manger attack leading to Information Leakage throu...

Regular Expression Denial Of Service (ReDoS)

django is vulnerable to Regular Expression Denial of Service ReDoS. A remote attacker is able to cause denial of service conditions through the EmailValidator or URLValidator functions via submitting a large number of domain name labels of emails and URLs...

Access Restriction Bypass

Oracle ManagedDataAccess is vulnerable to Access Restriction Bypass. The vulnerability exists due to the TCPS protocol stack which allows an attacker with network access to takeover the Oracle Data Provider for .NET...

Cross-Site Scripting (XSS)

nunjucks is vulnerable to Cross-Site Scripting XSS. The vulnerability is caused by a bypass of the html autoescape functionality when there are two user controlled parameters on the same line of a template, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Authentication Bypass

gradio is vulnerable to Authentication Bypass. The vulnerability exists due to the use of hard coded private ssh keys when sharing demos, which allows an attacker to gain access to other demos on the system...

NULL Pointer Dereference

openssl is vulnerable to null point dereference. The vulnerability exists because there is a missing check for the return value from the initialization function which later leads to invalid usage of the digest api most likely leading to a crash...

Remote Code Execution(RCE)

git is vulnerable to Remote Code ExecutionRCE. When parsing gitattributes, multiple integer overflows may occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge, causing overflows to be triggered via a...

Workload Injection

github.com/weaveworks/weave-gitops is vulnerable to workload injection. The library uses an S3 bucket for synchronising files, with no security controls to block unauthorised access in its endpoint, which allows local users on the same machine to see and alter the bucket content...

Cross-site Scripting (XSS)

graphite-web is vulnerable to cross-site scripting. The vulnerability exists because the views.py does not properly escape the template name attribute before being rendered, allowing an attacker to inject and execute malicious JavaScript...

Denial Of Service (DoS)

@fastify/websocket and fastify-websocket are vulnerable to denial of service. The vulnerability is due to the fastifyWebsocket function in index.js which crashes the application on an uncaught exception when processing a malformed packet...

Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to Sandbox Bypass. The vulnerability exists during the casting of array-like values to array types that intercepts per-element casts which allows an attacker to bypass sandbox restrictions and execute arbitrary codes...

Denial Of Service (DoS)

istio is vulnerable to denial of service. The vulnerability is due to the Kubernetes validating or mutating webhook service being exposed to the public, allowing a malicious attacker to send a specially crafted oversized message resulting in a crash to the control plane...

Information Leak

Linux Kernel is vulnerable to information leak. It is possible due to a flaw in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux kernel, allowing a local attacker with a special user privilege CAPSYSADMIN or CAPSYSRAWIO to create issues with confidentiality...

OS Command Injection

node is vulnerable to OS Command Injection. The vulnerability exists due to the insufficient sanitizations in IsIPAddress function of inspectorsocket.cc, which allows an attacker to gain control of the victim's router by performing DNS rebinding attacks via DBS requests...

Arbitrary File Read

ruby-mysql is vulnerable to arbitrary file read. A malicious MySQL server can request local file content from a client without explicit authorization from the user if the filename specified by the server does not match with OPTLOADDATALOCALDIR...

Denial Of Service (DoS)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated...

XML External Entity (XXE) Injection

WSO2 Identity Application Management Component is vulnerable to XML external entity attacks. The vulnerability exists in unmarshalSP function in ApplicationManagementServiceImpl.java because the SP file content is not parsed securely during unmarshalling which allows an attacker to gain access to...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Denial Of Service (DoS)

vim is vulnerable to denial of service. The vulnerability exists due to a heap-based buffer overflow which allows an attacker to cause an application crash...

Use-After-Free

Linux kernel is vulnerable to use-after-free attacks. The vulnerability exists through inconsistency of drivers/tty/ttyio.c and drivers/tty/ttyjobctrl.c. An attacker could use this flaw to crash the system...

Man-in-the-Middle (MitM)

postgresql is vulnerable to man-in-the-middle attacks. A man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first created when the server is configured to use trust authentication with a 'clientcert' requirement or to utilize 'cert' authentication...

Information Disclosure

openjdk is vulnerable to information disclosure. A low privileged attacker with network access is able to gain unauthorized access to critical data or complete access to openjdk...

Denial Of Service (DoS)

ntfs-3g:sid is vulnerable to denial of service. When a specially crafted NTFS inode pathname is supplied in an NTFS image, a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution...

Server-Side Forgery Request

xstream is vulnerable to Server-Side Forgery Request. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request...

Denial Of Service (DoS)

linux is vulnerable to a memory leak in Linux kernel in llcpsockconnect...

Denial Of Service (DoS)

unbound is vulnerable to denial of service. There is no available reproducer or proof of concept for this issue, nor it was ever proven the integer overflow can lead to a buffer overflow in practice...

Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to a type confusion when processing maliciously crafted web content...

Unauthorised Data Deletion

webkit2gtk is vulnerable to unauthorised data deletion. A user may be unable to fully delete browsing history. “Clear History and Website Data” did not clear the history in some circumstances...

OS Command Injection

salt is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands via a malicious process name through the restartcheck function...

Remote Code Execution (RCE)

Mumble is vulnerable to remote code execution. The vulnerability exists when a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text...

Remote Code Execution

bind9 is vulnerable to remote code execution. A buffer overflow in GSSAPI security policy negotiation can result in remote code execution...

Information Disclosure

netty-codec-http is vulnerable to information disclosure. When netty's multipart decoders are used, local files containing confidential information can be accessed via the local system temporary directory if temporary storing uploads on the disk is enabled...

Denial Of Service (DoS)

Xen is vulnerable to denial of service. A stack overflow due to recursive function calls allows an attacker to crash the application...

Prototype Pollution

ini is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Denial Of Service (DoS)

linux kernel is vulnerable to denial of service. An out-of-bounds error in scalar32minmaxor in kernel/bpf/verifier.c during the use of 64-bit values allows an attacker to crash the kernel...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. An invalid read location in vgaconinvertregion allows an attacker to crash the kernel and potentially obtain confidential information...

Remote Code Execution (RCE)

kernel is vulnerable to remote code execution RCE. The vulnerability exists through a buffer over-write in vgaconscroll...

Denial Of Service (DoS)

QEMU is vulnerable to denial of service. A use after free vulnerability in ipreass in ipinput.c of libslirp allows an attacker to crash the application using malicious packets...