39263 matches found
Security Constraint Bypass
Tomcat Catalina is vulnerable to security constraint bypasses. If an error page is a static file, catalina is supposed to serve the content of the file as if processing a GET request, regardless of the HTTP method used. Catalina, however, did not do this. This leads to unexpected results for stat...
Timing Attacks
OpenSSL is vulnerable to timing attacks. The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2 doesn't check MAC addresses in constant time during the processing of a malformed CBC padding. This is also known as the "Lucky Thirteen" issue...
Side Channel Attack On Modular Exponentiation
OpenSSL is vulnerable to side channel attacks. The vulnerability exploits cache-bank conflicts on the Intel Sandy-Bridge microarchitecture, exposing RSA keys. However, an attacker can only exploit this only if he has control of code in a thread running on the same hyper-threaded core as the victi...
Denial Of Service (DoS) Via Integer Overflow
OpenSSL is vulnerable to Denial Of Service DoS attacks. A malicious user can cause an integer overflow via the MDC2Update function which can lead to an integer overflow. A malicious user can make use of this to cause a heap corruption or a denial of service...
Information Disclosure
mcrypt is vulnerable to information exposure. The vulnerability exists because TLS, SSH, and IPSec protocols have missing validate birthday bound which allows to remote attack access confidential information in system...
Input Validation Bypass
ai is vulnerable to Input Validation Bypass. The vulnerability is due to improper validation of uploaded file types, which allows an attacker to bypass filetype whitelists and upload unauthorized files...
Security Sandbox Bypass
getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to insufficient protection of the Twig template sandbox, which allows an authenticated user with editor permissions to inject malicious template directives and execute arbitrary code on the server...
XML External Entity (XXE)
org.jenkins-ci.plugins, generic-webhook-trigger is vulnerable to XML External Entity XXE. The vulnerability is due to improper XML parser configuration that does not disable external entity processing, which allows an attacker to exploit crafted XML input to access sensitive information or perfor...
Cross-site Scripting (XSS)
Liferay Portal is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization due to the message boards feature allowing remote authenticated attackers to inject malicious JavaScript via the web interface...
Regular Expression Denial Of Service (ReDoS)
brace-expansion is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient handling of complex or nested patterns in regular expressions within the expand function of the file index.js, allows an attacker to remotely cause excessive resource consumption...
Command Injection
github.com/hashicorp/go-getter is vulnerable to Command Injection. The vulnerability is caused by improper handling of arguments in Git operations within getgit.go. This allows attackers to manipulate the Git configuration and execute arbitrary code...
SQL Injection
opencart/opencart is vulnerable to SQL Injection. The vulnerability is due to insufficient validation in the Divido payment extension, allowing an anonymous unauthenticated user to exploit SQL injection to gain unauthorized access to the backend database...
Arbitrary JavaScript Execution
react-pdf is vulnerable to Arbitrary JavaScript Execution. This vulnerability is due to isEvalSupported set to true by default, allowing for the execution of arbitrary JavaScript code embedded within the PDF...
Server-Side Request Forgery (SSRF)
org.apache.cxf, cxf-rt-databinding-aegis is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due improper URL sanitisation which allows an attacker to perform SSRF attacks on web services that take at least one parameter of any type. Users of other data bindings, including the...
Heap-use-after-free
sixlabors.imagesharp is vulnerable to a Heap-use-after-free. The vulnerability is due to improper handling of specially crafted PNG image files during conversion in its PngDecoderCore.cs file's InitializeImage function, potentially leading to information disclosure...
Information Exposure
sanitize-html is vulnerable to Information Exposure. The vulnerability is due to the parsing of CSS through the style attribute without disabling source maps, which can allow attackers to infer the file system structure and dependencies of the server...
Insecure Deserialization/Unsafe Attributes Merge
phenx/php-svg-lib is vulnerable to Insecure Deserialization. The vulnerability is caused due to unsafe attributes such as href, xlink:href and id while merging attributes from the tag to the tag when handling a tag that references an tag. This can lead to an unsafe file read that can cause PHAR...
Missing Encryption Of Sensitive Data
curl is vulnerable to Missing Encryption of Sensitive Data. The vulnerability is due to When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use...
LDAP Injection
keycloak-ldap-federation, keycloak-services is vulnerable to LDAP Injection. The vulnerability is due to the getFilterById function in LDAPOperationManager.java and getUserFromForm function in AbstractUsernameFormAuthenticator.java. This allows an attacker to manipulate the LDAP query in...
Denial Of Service (DoS)
pillow is vulnerable to Denial of Service DoS. The vulnerability is due to a lack of a max string size for an image font in ImageFont.py which can result in unbounded allocation of memory to process a given task, resulting in an out of memory error resulting in Denial of Service...
Remote Code Execution
activemq is vulnerable to Remote Code Execution. The vulnerability is due to BaseDataStreamMarshaller.java as there is no class validation and does not verify that the loaded class is a valid Throwable. This allows an attacker to manipulate serialized class types within the OpenWire protocol,...
Authorization Bypass
Org.apache.zookeeper: zookeeper is vulnerable to authorization bypass. This vulnerability exists due to improper implementation of a User-Controlled Key for user authentication, allowing an attacker to gain access to the system and perform unauthorized actions. Note that this vulnerability is onl...
Denial Of Service
grpc is vulnerable to Denial Of Service. The vulnerability is due to improper error handling in TCP server which allows an attacker to initiate number of concurrent connections with the server leading to denial of service...
Man-in-the-Middle (MitM)
open-vm-tools is vulnerable to Man-in-the-Middle MitM attacks. This vulnerability can be exploited by an attacker with man-in-the-middle MITM network positioning between vCenter and the ESXi host hosting the virtual machine to bypass SAML token signature verification, to perform VMware Tools Gues...
Access Restriction Bypass
chromium is vulnerable to Access Restriction Bypass. The vulnerability exists due to inappropriate implementation in Blink in Google Chrome which allows a remote attacker to perform arbitrary read/write via a crafted HTML page...
Remote Code Execution (RCE)
redis is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that Redis handles cJSON and cmsgpack libraries. An attacker can exploit this vulnerability to cause Redis to crash or to execute arbitrary code...
Denial Of Service (DoS)
openssl is vulnerable to Denial of Service DoS. The vulnerability causes applications using 'OBJobj2txt' directly, or use any OpenSSL subsystem with no message size limit to experience notable to very long delays when processing those messages, which may lead to a Denial of Service...
Authorization Bypass
libssh.so is vulnerable to Authorization Bypass. The vulnerability exists in the pkicrypto.c because the pkiverifydatasignature can accept invalid signatures when some memory allocations fail...
Denial Of Services (DoS)
Linux kernel is vulnerable to Denial Of Services DoS. The vulnerability exists due to the heap-based buffer overflow in the library due to the lack of proper validation of the length of user-supplied data before copying it to a fixed length, which allows an attacker to cause an application crash ...
Use After Free
chromium is vulnerable to Use After Free. Vulnerability is available within 'WebProtect' in 'Google Chrome' which allows an attacker to commit heap corruption via a crafter HTML page...
User Impersonation
keycloak-services is vulnerable to User Impersonation. The vulnerability is due to the OpenID Connect user authentication because the session UUID is not properly bound to the user session, allowing an attacker to obtain a certain piece of information from a user request in the same realm and...
Timing Attack
openssl is vulnerable to Timing Attack. The vulnerability exists in rsa/rsaossl.c because an attacker can recover ciphertext with a Bleichenbacher style attack by sending a large number of trial messages...
Remote Code Execution
shopware is vulnerable to Remote Code Execution RCE. An attacker with access to a Twig environment is able to use templates to call any global PHP function with filters such as map, filter, and sort, which allows an attacker to upload and execute malicious code on the system...
Information Disclosure
curl is vulnerable to Information Disclosure. An attacker may force the library to use an insecure clear-text HTTP step even when HTTPS is provided in the URL. The HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts ...
Denial Of Service (DoS)
cn.hutool:hutool-core is vulnerable to denial of service DoS attacks. A malicious user is able to cause excessive resource consumption due to improper decompression mechanisms in multiple functions of ZipUtil.java, resulting in an application crash...
Denial Of Service (DoS)
Linux Kernel is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the l2capreassemblesdu function in l2capcore.c which allows an attacker to cause an application crash...
Regular Expression Denial Of Service (ReDoS)
loader-utils is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to insecure regular expression in the url variable of the interpolateName function in interpolateName.js. A remote attacker can cause denial of service via malicious regex...
Improper Access Control
openssl is vulnerable to improper access control. The vulnerability exists in evpmdinitinternal and evpcipherinitinternal functions of digest.c and evpenc.c respectively which allows an attacker to incorrectly pass NIDundef as this value in the call to EVPCIPHERmethnew...
Denial Of Service (DoS)
libdhcp.so is vulnerable to Denial Of Service DoS. The vulnerability exists when the function optioncodehashlookup is called from addoption in option.c due to the option's refcount field which allows an attacker to crash the application via malicious input...
Arbitrary Code Execution Via Authorization Bypass
Pebble Templates is vulnerable to arbitrary code execution via authorization bypass. The vulnerability exists in BlacklistMethodAccessValidator.java because the methods that are allowed to access by pebble are not properly handled which allows an attacker to bypass and execute arbitrary codes...
Use-After-Free
libexpat.so is vulnerable to use-after-free. The vulnerability is possible because the raw names will be pointing into the stored entity value instead of the parse buffer in doContent method of the file xmlparse.c, which doesn't release the consumed memory...
Cookie Injection
react/http is vulnerable to cookie injection. The vulnerability exists due to a lack of sanitization in the decode function in urldecode in Message/ServerRequest.php allowing an attacker to counterfeit cookies...
Deserialization Of Untrusted Data
apache-geode is vulnerable to deserialization of untrusted data. The vulnerability exists because the serialization filtering is not properly configured for JMX/RMI which allows an attacker to to inject and execute arbitrary code through the untrusted data...
Insecure Token
An issue was found in fts5UnicodeTokenize in ext/fts5/fts5tokenize.c in Sqlite. A unicode61 tokenizer configured to treat unicode "control-characters" class Cc, was treating embedded nul characters as tokens. The issue was fixed in sqlite-3.34.0 and later...
Stored Cross-Site Scripting (XSS)
github.com/grafana/grafana is vulnerable to stored cross-site scripting attacks. The attack is possible because the library does not sanitize the runbookURL parameter of RuleDetailsActionButtons.tsx file, which allows remote authenticated attackers to inject and execute malicious javascript on th...
Heap Buffer Overflow
chromium is vulnerable to a Heap Buffer Overflow. The vulnerability allows an attacker to crash the system through potentially exploit heap corruption via a crafted HTML page...
SQL Injection
django is vulnerable to SQL injection. An attacker is able to execute arbitrary SQL commands via the Trunc and Extract database functions which allows an attacker to execute arbitrary sql queries...
Use-After-Free
vim is vulnerable to use after free. The vulnerability exists in utfptr2char function in mbyte.c because the freed memory is used when searching for pattern in path which allows an attacker to cause a memory corruption causing an application crash...
Denial Of Service (DoS)
Apache HTTP Server is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization with modsed in contexts where the input to modsed may be very large, modsed may make excessively large memory allocations and trigger an abort...