Sensitive Information Disclosure

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

Heap-based Out-Of-Bounds Write

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way IP packets with an Internet Header Length ihl of zero were processed in the skbflowdissect function in the Linux kernel. A remote attacker could use this flaw to trigger an infinit...

Open Redirect

Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. Refer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information about the changes in this release. The Release Notes will be available shortly fr...

Arbitrary Code Execution

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...

Memory Corruption

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...

Denial Of Service (DoS)

MySQL is vulnerable to denial of service DoS. It allows remote attackers to affect availability via unknown vectors...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcpcollapseofoqueue and tcppruneofoqueue functions by...

Privilege Escalation

github.com/kubernetes/kubernetes is vulnerable to privilege escalation. Authenticated users are able to directly access a backend server through the Kubernetes API server using specially crafted requests. A remote attacker who is authenticated to the Kubernetes API server only will be able to sen...

Arbitrary Code Execution

kernel-rt is vulnerable to arbitrary code execution attacks. The vulnerability exists as a race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write COW feature to write to a read-only memo...

Arbitrary File Write

jbossweb is vulnerable to arbitrary file write attacks. The vulnerability exists as the readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to...

Denial Of Service (DoS)

openssl is vulnerable to denial of service DoS attacks. A malicious user can pass a large prime number during a TLS handshake that can cause the client to take a long time generating a key for this, leading to the client hanging and possibly crashing...

Security Constraint Bypass

tomcat-catalina is vulnerable to security constraint bypass. Security constraints are only applied after a servlet has already been loaded. Depending on the order in which the servlets were loaded, its possible that some of the constraints were not applied at all. Leveraging this, users may have...

Escalation Of Privileges

puppet is vulnerable to escalation of privileges through world writable permissions. The vulnerabilities exists through modules which are unpacked with minitar, allowing files to be unpacked with higher privileges...

Incorrect Key Verification

ansible is vulnerable to incorrect key verification. The library does not verify key fingerprints before uploading them. This allows a malicious user to generate a key with the desired 16 digit id and upload it to the server...

Timing Attacks

OpenSSL is vulnerable to timing attacks. The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2 doesn't check MAC addresses in constant time during the processing of a malformed CBC padding. This is also known as the "Lucky Thirteen" issue...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible because the AES-NI functionality for TLS 1.1 and 1.2 can cause an application crash through CBC data...

Denial Of Service (DoS) Through Null Pointer Dereference

OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible when SSLMODERELEASEBUFFERS is enabled because OpenSSL does not correctly manage a buffer point during recursive calls...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can cause a memory leak by seeking to connect to the system with an invalid username. By opening multiple invalid connections this way, the malicious user can cause the system to run out of memory...

Buffer Overflow

OpenSSL is vulnerable to buffer overflow. A malicious user can pass a large amount of data to the EVPEncryptUpdate function after calling that function previously with a partial block can cause the length check to overflow. This can be used to crash the application...

Information Disclosure

mcrypt is vulnerable to information exposure. The vulnerability exists because TLS, SSH, and IPSec protocols have missing validate birthday bound which allows to remote attack access confidential information in system...

Remote Code Execution (RCE)

RESTEasy is vulnerable to remote code execution. SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy uses SnakeYAML and enables the yaml provider by default, under certain conditions, RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of...

Security Sandbox Bypass

getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to insufficient protection of the Twig template sandbox, which allows an authenticated user with editor permissions to inject malicious template directives and execute arbitrary code on the server...

Server-Side Request Forgery

next is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of the Host header within Server Actions. This allows an attacker to make unauthorized requests that appear to originate from the Next.js application server, allowing access to internal network...

Improper Signature Validation

python-jose is vulnerable to Improper Signature Validation. This vulnerability is due to improper verification of OpenSSH ECDSA keys along with other key formats, allowing attackers to bypass security measures or manipulate cryptographic functions by submitting crafted signatures with a specific...

Heap-use-after-free

sixlabors.imagesharp is vulnerable to a Heap-use-after-free. The vulnerability is due to improper handling of specially crafted PNG image files during conversion in its PngDecoderCore.cs file's InitializeImage function, potentially leading to information disclosure...

Sandbox Escape

runc is vulnerable to Sandbox Escape. The vulnerability is caused due to an internal file descriptor leak in runc. An attacker can exploit the leaked file descriptors to cause a newly-spawned container process, initiated by the runc exec command, to have a working directory in the host filesystem...

Request Smuggling

aiohttp is vulnerable to Request Smuggling.The vulnerability is caused due to improper parsing of HTTP requests within httpparser.py. This flaw results in excessive resource consumption on the application server, resulting in Denial of Service DoS and/or Request Smuggling...

Missing Encryption Of Sensitive Data

curl is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use...

Path Traversal

golang is vulnerable to Path Traversal. The vulnerability is due to a lack of file path validation in pathwindows.go. This can allows an attacker to access arbitrary locations on a Windows system...

Denial Of Service (DoS)

github.com/golang/go is vulnerable to Denial Of Service DoS. The vulnerability exists because handshakeclient.go does not set a max RSA key size, which can lead to extremely large RSA keys in certificate chains causing a client to expend significant CPU time to verify signatures. The fix sets the...

Credentials Leaks

cas-server-support-x509-core is vulnerable to Credentials Leaks. The vulnerability exists because the prepareConnectionFactory function of LdaptiveResourceCRLFetcher.java does not properly validate the ldapURL parameter provided by the certificate, leaking the credentials for LDAP authentication ...

File Upload Validation Bypass

Django is vulnerable to File Upload Validation Bypass. The vulnerability exists due to the FileInput class in widgets.py because uploading multiple files using one form field has never been officially supported by forms.FileField or forms.ImageField as only the last uploaded file was validated,...

Denial Of Service (DoS)

go is vulnerable to Denial of Service DoS. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files, causing the application to crash...

Improper Signature Validation

Zip4j is vulnerable to Improper Signature Validation. The vulnerability is due to improper AES Message Authentication Code MAC validation when the MAC signature got corrupted in an encrypted ZIP archive. This flaw can result in an attacker modifying the archive without the library detecting the...

Remote Code Execution

shopware is vulnerable to Remote Code Execution RCE. An attacker with access to a Twig environment is able to use templates to call any global PHP function with filters such as map, filter, and sort, which allows an attacker to upload and execute malicious code on the system...

Prototype Pollution

flat is vulnerable to prototype pollution. The vulnerability exists in the unflatten function of index.js, due to the improper checks for the key1 variable which allows an attacker to modify object prototype attributes...

Out-of-bounds Write

kernel is vulnerable to Out-of-bounds Write. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reservesfasize function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access which allows a loca...

Type Confusion

qt5-qtwebengine is vulnerable to type confusion. A remote attacker is able to potentially exploit heap corruption via a crafted HTML page resulting in type confusion vulnerability...

Remote Code Execution (RCE)

quarkus-vertx-http is vulnerable to remote code execution. The vulnerability exists in multiple functions due to drive-by localhost attacks which allows an attacker to inject and execute malicious query parameters via the Dev UI Config Editor...

Server-side Request Forgery (SSRF)

moodle/moodle is vulnerable to server-side request forgery. An attacker can make HTTP requests to untrusted URLs through the send function of HTTPMessage.php and gain access to sensitive information through the LTI provider library...

Information Disclosure

System.Data.SqlClient and Microsoft.Data.SqlClient packages in the .NET framework are vulnerable to information disclosure. The vulnerability occurs during heavy load, which lets an attacker access arbitrary data from asynchronously executed queries...

Information Disclosure

rh-mysql80-mysql is vulnerable to denial of service. The vulnerability exists in the Server: PAM Auth Plugin component, allowing an attacker to access critical data or complete access to all MySQL Server accessible data...

Improper Access Control

openssl is vulnerable to improper access control. The vulnerability exists in evpmdinitinternal and evpcipherinitinternal functions of digest.c and evpenc.c respectively which allows an attacker to incorrectly pass NIDundef as this value in the call to EVPCIPHERmethnew...

Denial Of Service (DoS)

libbind9.so is vulnerable to denial of service. The vulnerability exists because the DNSSEC verification code used in the library for the ECDSA algorithm leaks memory when the signature length is mismatched, allowing an attacker to cause an application crash...

Information Disclosure

github.com/containers/buildah is vulnerable to information disclosure. The vulnerability exists in configureUIDGID function in runcommon.go due to improper handling of the supplementary groups in the Buildah container engine which allows an attacker to gain access to containers and perform...

Denial Of Service (DoS)

snakeyaml is vulnerable to Denial Of Service DoS. The vulnerability exists in the Composer function of Composer.java as it does not properly restrict the nested depth limitation for collections, allowing an attacker to crash the application through the stack overflow by providing malicious yaml...

Privilege Escalation

moodle/moodle is vulnerable to privilege escalation. The vulnerability exists due to application does not properly impose security restrictions in assigning roles which allows a remote attacker to escalate privileges on the system...

Regular Expression Denial Of Service (ReDoS)

terser is vulnerable to regular expression denial of service. The vulnerability exists in index.js and evaluate.js because regular expressions used are not properly handled which allows an attacker to send crafted requests which causes an application crash...

HTTP Request Smuggling

llhttp is vulnerable to HTTP request smuggling. The vulnerability exists because the http.js does not properly handle the CRLF sequence, allowing an attacker to smuggle HTTP requests by submitting LF characters without CR...

SQL Injection

django is vulnerable to SQL injection. An attacker is able to execute arbitrary SQL commands via the Trunc and Extract database functions which allows an attacker to execute arbitrary sql queries...