Lucene search
+L
VeracodeMost viewed

38790 matches found

Veracode
Veracode
•added 2019/05/02 5:20 a.m.•51 views

Sandbox Restrictions Bypass

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to...

5.9CVSS6.7AI score0.14714EPSS
SaveExploits0References28Affected Software5
Veracode
Veracode
•added 2019/05/02 4:52 a.m.•51 views

Remote Code Execution (RCE)

php is vulnerable to remote code execution. An integer signedness issue, leading to a heap-based buffer underflow, was found in the PHP scandir function. If a remote attacker could upload an excessively large number of files to a directory the scandir function runs on, it could cause the PHP...

10CVSS7.4AI score0.10467EPSS
SaveExploits1References24Affected Software2
Veracode
Veracode
•added 2019/05/02 4:44 a.m.•51 views

Input Validation Bypass

Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines. The latest packages for Subscription Asset Manager include a number of security fixes: When a Subscription Asset Manager instance is created, its configuration script...

7.5CVSS8AI score0.13911EPSS
SaveExploits2References11Affected Software11
Veracode
Veracode
•added 2019/05/02 4:42 a.m.•51 views

Information Disclosure

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

10CVSS6AI score0.6477EPSS
SaveExploits8References23Affected Software204
Veracode
Veracode
•added 2019/05/02 4:42 a.m.•51 views

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user...

9.8CVSS7.8AI score0.99998EPSS
SaveExploits65References9Affected Software1
Veracode
Veracode
•added 2019/01/15 9:21 a.m.•51 views

Remote Code Execution (RCE)

kernel is vulnerable to remote code execution RCE attacks. The vulnerability exists as the Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of...

8CVSS8.3AI score0.84172EPSS
SaveExploits15References19Affected Software2
Veracode
Veracode
•added 2019/01/15 9:21 a.m.•51 views

Information Disclosure

java-1.7.0-openjdk is vulnerable to information disclosure attacks. The vulnerability exists as a vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131...

3.1CVSS4.8AI score0.02224EPSS
SaveExploits0References13Affected Software2
Veracode
Veracode
•added 2019/01/15 8:57 a.m.•51 views

Denial Of Service (DoS)

httpd is vulnerable to denial of service DoS attacks. The vulnerability exists as the deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service resourc...

4.3CVSS4.2AI score0.37156EPSS
SaveExploits0References65Affected Software141
Veracode
Veracode
•added 2019/01/15 8:53 a.m.•51 views

SQL Command Injection

SQL injection vulnerability in the ActiveRecord component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use...

7.5CVSS7.7AI score0.04458EPSS
SaveExploits2References12Affected Software22
Veracode
Veracode
•added 2018/10/12 2:43 a.m.•51 views

Arbitrary File Upload

blueimp-file-upload is vulnerable to arbitrary file upload. The file-type and file-name of uploaded files were not validated in server/php/UploadHandler.php, which allows an unauthenticated remote attacker to upload a malicious file containing PHP code and execute arbitrary commands on the server...

9.8CVSS9.9AI score0.97255EPSS
SaveExploits17References11Affected Software1
Veracode
Veracode
•added 2018/06/13 3:48 a.m.•51 views

Denial Of Service (DoS)

openssl is vulnerable to denial of service DoS attacks. A malicious user can pass a large prime number during a TLS handshake that can cause the client to take a long time generating a key for this, leading to the client hanging and possibly crashing...

7.5CVSS7.6AI score0.48831EPSS
SaveExploits0References42Affected Software3
Veracode
Veracode
•added 2018/02/12 6:28 a.m.•51 views

Escalation Of Privileges

puppet is vulnerable to escalation of privileges through world writable permissions. The vulnerabilities exists through modules which are unpacked with minitar, allowing files to be unpacked with higher privileges...

5.5CVSS6.2AI score0.00356EPSS
SaveExploits0References5Affected Software222
Veracode
Veracode
•added 2017/07/25 6:56 a.m.•51 views

Cross-Site Request Forgery(CSRF)

Wordpress is vulnerable to cross-site request forgery CSRF attacks. The attacks can be launched because wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php have flaws, allowing the widget-access action requests to be hijacked by the attackers...

8.8CVSS9AI score0.01904EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2017/02/10 2:08 a.m.•51 views

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service. The vulnerability exists in the d2iECPrivateKey function due to a use-after-free which allows an attacker to crash the application via a malformed Elliptic Curve private-key file...

6.8CVSS5.4AI score0.1633EPSS
SaveExploits0References48Affected Software2
Veracode
Veracode
•added 2017/01/26 4:15 a.m.•51 views

Denial Of Service Through Integer Overflow

OpenSSL has denial of service through integer overflow vulnerability. The vulnerability is caused due to the use of externally supplied data for SIZE bytes for memory allocation, thereby allowing malicious user to cause heap/memory corruption...

9.8CVSS9.2AI score0.44505EPSS
SaveExploits1References65Affected Software3
Veracode
Veracode
•added 2014/06/06 6:13 p.m.•51 views

Class Loader Manipulation With CookieInterceptor

Struts 2 Core is vulnerable to class loader manipulation vulnerability. The vulnerability exists because the getClass method does not properly restrict access to cookies as it accepts all cookie names when "\" is used to configure cookiesName parameter which allows remote attackers to manipulate...

7.5CVSS8.8AI score0.99524EPSS
SaveExploits8References10Affected Software2
Veracode
Veracode
•added 2026/05/23 5:24 a.m.•50 views

Authorization Bypass

9router is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization handling in the Administrative API endpoint /api, which allows an attacker to bypass access controls and perform unauthorized actions remotely...

7.5CVSS7.1AI score0.00313EPSS
SaveExploits0References8Affected Software1
Veracode
Veracode
•added 2025/09/18 7:48 a.m.•50 views

Server-Side Request Forgery (SSRF)

phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper input validation because the setPath method in the PhpOffice\PhpSpreadsheet\Worksheet\Drawing class allows attackers to craft requests to internal resources...

8.7CVSS7AI score0.00792EPSS
SaveExploits0References9Affected Software1
Veracode
Veracode
•added 2024/07/09 6:06 a.m.•50 views

Improper Encoding

Apache HTTP Server is vulnerable to Improper Encoding. The vulnerability is caused due to Substitution encoding issue in modrewrite. This allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to...

9.8CVSS6.6AI score0.02456EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2024/06/24 8:11 a.m.•50 views

SQL Injection

opencart/opencart is vulnerable to SQL Injection. The vulnerability is due to insufficient validation in the Divido payment extension, allowing an anonymous unauthenticated user to exploit SQL injection to gain unauthorized access to the backend database...

8.1CVSS8AI score0.1908EPSS
SaveExploits2References3Affected Software1
Veracode
Veracode
•added 2024/06/11 8:54 a.m.•50 views

Denial Of Service (DoS)

langchain is vulnerable to a Denial-of-Service DoS. The vulnerability is due to infinite recursion in the parsesitemap method, which results in an infinite loop that exceeds the maximum recursion depth in Python...

4.7CVSS6.7AI score0.00304EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
•added 2024/02/26 5:54 a.m.•50 views

Information Exposure

sanitize-html is vulnerable to Information Exposure. The vulnerability is due to the parsing of CSS through the style attribute without disabling source maps, which can allow attackers to infer the file system structure and dependencies of the server...

5.3CVSS6.7AI score0.01027EPSS
SaveExploits1References6Affected Software1
Veracode
Veracode
•added 2024/01/08 6:30 a.m.•50 views

Information Leak

pycryptodome and pycryptodomex are vulnerable to Information Leakage. The vulnerability is caused due to a side-channel leakage for OAEP decryption Optimal Asymmetric Encryption Padding used during RSA encryption. This can be exploited to mount a Manger attack leading to Information Leakage throu...

5.9CVSS7AI score0.00618EPSS
SaveExploits0References3Affected Software2
Veracode
Veracode
•added 2023/10/21 5:10 p.m.•50 views

Remote Code Execution (RCE)

exim4 is vulnerable to Remote Code Execution RCE. A memory corruption vulnerability exists in the smtp service of Exim, which listens on TCP port 25 by default that allows an attacker to execute arbitrary code on a vulnerable system by sending a specially crafted SMTP message...

8.1CVSS8.2AI score0.0572EPSS
SaveExploits0
Veracode
Veracode
•added 2023/10/21 7:38 a.m.•50 views

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS. This vulnerability allows an attacker to exhaust worker resources in the server by opening an HTTP/2 connection with an initial window size of 0...

7.5CVSS6.7AI score0.70595EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/08/30 10:31 p.m.•50 views

Denial Of Service (DoS)

python3.9 is vulnerable to Denial of Service DoS attacks. This vulnerability exists due to a flaw in the way the plistlib module parses certain Apple Property List plist files in binary format. A remote attacker can exploit this vulnerability by sending a specially crafted plist file, which could...

6.5CVSS6.5AI score0.01651EPSS
SaveExploits1References4Affected Software3
Veracode
Veracode
•added 2023/08/14 3:44 a.m.•50 views

Denial Of Service (DoS)

gRPC is vulnerable to Denial Of Service DoS. The vulnerability exists because the file descriptor is not properly handled, which leads to the termination of the connection between a proxy and a backend when a hpack table accounting errors occur, allowing an attacker to cause an application crash ...

7.5CVSS6.7AI score0.00479EPSS
SaveExploits0References7Affected Software3
Veracode
Veracode
•added 2023/08/07 9:33 a.m.•51 views

Business Logic Errors

github.com/answerdev/answer is vulnerable to Business Logic Errors. The vulnerability exists due to a lack of server side logic for account deletion, which allows an authenticated attacker to delete the administrator account...

5.4CVSS6.7AI score0.0075EPSS
SaveExploits1References3Affected Software1
Veracode
Veracode
•added 2023/08/07 1:26 a.m.•50 views

Cross-Site Scripting (XSS)

odoo is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability allows a remote attacker to inject arbitrary web script via the browser of a victim, by posting crafted content...

6.1CVSS5.9AI score0.00545EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/08/06 5:09 p.m.•50 views

Remote Code Execution (RCE)

redis is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that Redis handles cJSON and cmsgpack libraries. An attacker can exploit this vulnerability to cause Redis to crash or to execute arbitrary code...

8.8CVSS7.8AI score0.41409EPSS
SaveExploits1References5Affected Software1
Veracode
Veracode
•added 2023/05/21 11:53 a.m.•50 views

Authorization Bypass

libssh.so is vulnerable to Authorization Bypass. The vulnerability exists in the pkicrypto.c because the pkiverifydatasignature can accept invalid signatures when some memory allocations fail...

6.5CVSS6.8AI score0.01061EPSS
SaveExploits2References12Affected Software3
Veracode
Veracode
•added 2023/05/09 4:43 p.m.•50 views

Access Restriction Bypass

Oracle ManagedDataAccess is vulnerable to Access Restriction Bypass. The vulnerability exists due to the TCPS protocol stack which allows an attacker with network access to takeover the Oracle Data Provider for .NET...

7.5CVSS7.4AI score0.00594EPSS
SaveExploits0References2Affected Software2
Veracode
Veracode
•added 2023/04/28 5:14 a.m.•50 views

Use After Free

chromium is vulnerable to Use After Free. Vulnerability is available within 'WebProtect' in 'Google Chrome' which allows an attacker to commit heap corruption via a crafter HTML page...

8.8CVSS9AI score0.00853EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2023/03/21 12:30 a.m.•50 views

Authentication Bypass

curl is vulnerable to Authentication Bypass. The library would reuse a previously created connection even if the GSS delegation CURLOPTGSSAPIDELEGATION option had been changed, but this setting was left out from configuration match checks, affecting krb5/kerberos/negotiate/GSSAPI transfers...

5.9CVSS8.9AI score0.01566EPSS
SaveExploits1References10Affected Software4
Veracode
Veracode
•added 2023/03/04 3:40 p.m.•50 views

User Impersonation

keycloak-services is vulnerable to User Impersonation. The vulnerability is due to the OpenID Connect user authentication because the session UUID is not properly bound to the user session, allowing an attacker to obtain a certain piece of information from a user request in the same realm and...

5CVSS4.2AI score0.01274EPSS
SaveExploits2References4Affected Software2
Veracode
Veracode
•added 2023/02/18 7:30 p.m.•50 views

Type Confusion

sequelize is vulnerable to Type Confusion. A remote attacker is able to inject malicious content due to improper parameter filtering, which results in type confusion, leading to code injection...

9.9CVSS8.5AI score0.00809EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/01/18 12:45 a.m.•50 views

Privilege Escalation

device-mapper-multipath is vulnerable to privilege escalation. The library allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This...

7.8CVSS7.5AI score0.00677EPSS
SaveExploits4References3Affected Software1
Veracode
Veracode
•added 2022/12/18 8:41 p.m.•50 views

Denial Of Service (DoS)

cn.hutool:hutool-core is vulnerable to denial of service DoS attacks. A malicious user is able to cause excessive resource consumption due to improper decompression mechanisms in multiple functions of ZipUtil.java, resulting in an application crash...

7.5CVSS7AI score0.00897EPSS
SaveExploits1References3Affected Software1
Veracode
Veracode
•added 2022/12/06 12:17 p.m.•50 views

Denial Of Service (DoS)

Linux Kernel is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the l2capreassemblesdu function in l2capcore.c which allows an attacker to cause an application crash...

7.1CVSS7.5AI score0.01328EPSS
SaveExploits0References6Affected Software4
Veracode
Veracode
•added 2022/10/20 12:57 p.m.•50 views

Sandbox Bypass

Jenkins Script Security Plugin is vulnerable to Sandbox Bypass. The vulnerability exists during the casting of array-like values to array types that intercepts per-element casts which allows an attacker to bypass sandbox restrictions and execute arbitrary codes...

9.9CVSS9.2AI score0.01543EPSS
SaveExploits0References5Affected Software2
Veracode
Veracode
•added 2022/10/19 5:12 p.m.•50 views

Buffer Overflow

linux-lts, is vulnerable to buffer overflows. The vulnerability exists in linux kernel which allows an attacker to cause a memory corruption resulting in an application crash...

5.5CVSS6.9AI score0.00571EPSS
SaveExploits1References16Affected Software4
Veracode
Veracode
•added 2022/09/29 7:50 a.m.•50 views

Path Traversal

twig/twig is vulnerable to path traversal. The vulnerability exists in findTemplate function of FilesystemLoader.php because the template loading directories are not properly configured which allows an attacker to load templates outside the configured directory...

7.5CVSS7.4AI score0.02474EPSS
SaveExploits0References18Affected Software2
Veracode
Veracode
•added 2022/09/28 11:59 a.m.•50 views

Improper Certificate Validation

Apache Pulsar is vulnerable to improper certificate validation. The vulnerability exists due to man in the middle attacks in intra-cluster connections and geo-replication connections which allows an attacker to take control of a machine between the client and the server...

5.9CVSS5.7AI score0.00641EPSS
SaveExploits0References4Affected Software3
Veracode
Veracode
•added 2022/09/16 11:57 a.m.•50 views

Arbitrary Code Execution Via Authorization Bypass

Pebble Templates is vulnerable to arbitrary code execution via authorization bypass. The vulnerability exists in BlacklistMethodAccessValidator.java because the methods that are allowed to access by pebble are not properly handled which allows an attacker to bypass and execute arbitrary codes...

9.8CVSS9.6AI score0.01157EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
•added 2022/09/16 6:55 a.m.•50 views

Information Disclosure

github.com/containers/buildah is vulnerable to information disclosure. The vulnerability exists in configureUIDGID function in runcommon.go due to improper handling of the supplementary groups in the Buildah container engine which allows an attacker to gain access to containers and perform...

7.1CVSS6.9AI score0.00338EPSS
SaveExploits1References10Affected Software3
Veracode
Veracode
•added 2022/09/13 12:45 a.m.•50 views

Denial Of Service (DoS)

kernal is vulnerable to denial of service.The vulnerability exists due to memory leak and application crash in pfkeyregister function in afkey.c, which allows an attacker to crash the application by providing a malicious input...

7.1CVSS7.1AI score0.00398EPSS
SaveExploits0References8Affected Software2
Veracode
Veracode
•added 2022/08/29 4:37 a.m.•50 views

Privilege Escalation

librpm.so is vulnerable to privilege escalation. A local unauthenticated user who owns another ancestor directory is able to potentially gain root privileges of the system due to the lack of sanitizations in lib/fsm.c during symlink validations. This vulnerability exists due to incomplete fixes f...

7.8CVSS7.1AI score0.00506EPSS
SaveExploits1References6Affected Software2
Veracode
Veracode
•added 2022/07/17 5:23 p.m.•50 views

Heap Buffer Overflow

chromium is vulnerable to a Heap Buffer Overflow. The vulnerability allows an attacker to crash the system through potentially exploit heap corruption via a crafted HTML page...

8.8CVSS8.3AI score0.70461EPSS
SaveExploits0References11Affected Software5
Veracode
Veracode
•added 2022/06/22 12:42 p.m.•50 views

Command Injection

openssl is vulnerable to command injection. The vulnerability exists in crehash script which allows an attacker to inject and execute malicious commands...

9.8CVSS9.6AI score0.96275EPSS
SaveExploits1References15Affected Software19
Veracode
Veracode
•added 2022/06/16 5:18 p.m.•50 views

Privilege Escalation

linux is vulnerable to privilege escalation. The vulnerability exists due to a lack of sanitization of access to the kernel debugger when booted in secure boot environments allowing an attacker to bypass UEFI Secure Boot restrictions...

7.8CVSS7.4AI score0.00402EPSS
SaveExploits1References4Affected Software4
Total number of security vulnerabilities5000