38839 matches found
Denial Of Service (DoS) And Remote Code Execution (RCE)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user...
Information Disclosure
Python is an interpreted, interactive, object-oriented programming language. A denial of service flaw was found in the implementation of associative arrays dictionaries in Python. An attacker able to supply a large number of inputs to a Python application such as HTTP POST request parameters sent...
Denial Of Service (DoS)
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...
Arbitrary Code Execution
curl is vulnerable to arbitrary code execution attacks. The vulnerability exists as curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVEGSSAPI define was meanwhile substitute...
Denial Of Service (DoS) In SSL Alert Handling
OpenSSL is vulnerable to denial of service in SSL alert handling aka SSL-Death-Alert. The attacks are possible due to a flaw in the way SSL3ALWARNING are handled, consuming 100% CPU on the server...
Remote Code Execution (RCE)
kernel is vulnerable to remote code execution RCE attacks. The vulnerability exists as a use-after-free vulnerability in the sysrecvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is...
Information Disclosure
thunderbird is vulnerable to information disclosure attacks. The vulnerability exists as a use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows...
Privilege Escalation
kernel-rt is vulnerable to privilege escalation attacks. The vulnerability exists as an integer overflow in lib/asn1decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data...
Denial Of Service (DoS)
php is vulnerable to denial of service. Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
Remote Code Execution (RCE)
Django is vulnerable to remote code execution. The django.core.urlresolvers.reverse function allows remote attackers to use a view that constructs URLs to input a "dotted Python path" to import and execute Python modules...
Denial Of Service (DoS)
gnupg2 is vulnerable to denial of service DoS attacks. The vulnerability exists as the readblock function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service...
XML Encryption Backwards Compatibility Attack
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...
Deserialisation Of Untrusted Data
jackson-databind can deserialize untrusted data. The vulnerability is due to an incomplete fix for the CVE-2017-7525...
Remote Code Execution (RCE)
catalina is vulnerable to a remote code execution RCE attack. The library allows the replacement of the XML parser used for other web applications, allowing a malicious user to gain access to the applications' web.xml, context.xml or tld files...
Directory Traversal
JavaServer Faces is vulnerable to directory traversal. A malicious user can access arbitrary files through loc parameters in the function ResourceManager.java:getLocalePrefix...
Denial Of Service (DoS)
openpsa/midcom is vulnerable to denial of service Dos attacks. The library uses a vulnerable version of PHP and calls the insecure method xmlparseintostruct. This can allow a malicious user to upload an XML file with the RSS Upload feature to cause a buffer under read or segmentation fault that c...
Remote Code Execution (RCE)
safe-eval is vulnerable to remote code execution RCE. The application does not properly sanitize user input in object constructors, allowing a malicious user to break out of the Sandbox and execute arbitrary commands...
Directory Traversal
spring-webmvc is vulnerable to directory traversal attack. The vulnerability exists due to the improper sanitization of the path values which allows valid Windows files to be served as static resources. This vulnerability only affects spring-webmvc running on Windows which allows serving files wi...
Directory Traversal
wildfly-undertow is vulnerable to directory traversal attacks. The application does not handle pathing properly, allowing a malicious user to pass a URL to gain access to sensitive information on the system...
Vulnerability Through C Libraries
chef uses vulnerable versions of LibXML2, OpenSSL and LibXSLT. These vulnerabilities are included due to the omnibusoverride file using the vulnerable versions. LibXML2 is vulnerable to the following CVEs: CVE-2017-9050, CVE-2017-9049, CVE-2017-9048, CVE-2017-9047, CVE-2017-8872, and CVE-2016-931...
Directory Traversal
salt is vulnerable to directory traversal attacks. The attack is possible because of an incomplete fix for CVE-2017-12791. A malicious user can include escape characters and path separators into credentials when authenticating to a master to traverse the filesystem...
Remote Code Execution (RCE)
The nokogiri gem is susceptible to remote code execution RCE attacks. The attacks exist because the library uses the C package libxml2 which is vulnerable to CVE-2017-0663, allowing a malicious user to pass a XML file to execute arbitrary code or crash the application...
Buffer Overread
OpenSSL is vulnerable to buffer overreads. Attackers can cause a on-byte buffer overread by using a X.509 certificate with a malformed IPAddressFamily extension, as a result the certificate would incorrectly be displayed in clear text...
Security Constraint Bypass
Tomcat Catalina is vulnerable to security constraint bypasses. If an error page is a static file, catalina is supposed to serve the content of the file as if processing a GET request, regardless of the HTTP method used. Catalina, however, did not do this. This leads to unexpected results for stat...
Remote Code Execution (RCE) Through Deserialization
Jackson-databind is vulnerable to remote code execution attacks. These attacks are possible during bean deserialization and attackers are able to execute code and commands...
Information Disclosure
OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug that can allow a malicious user to gain information on the curve used for encryption during key negotiation using the Elliptic Curve Diffie-Hellman EC-DH Cipher...
Denial Of Service (DoS)
OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible due to multiple buffer overflows in crypto/srp/srplib.c. The buffer overflows can be triggered by an invalid SRP g, A or B parameter...
Access Restriction Bypass
OpenSSL is vulnerable to access restriction bypass. This is possible because OpenSSL does not enforce the no-ssl3 build option, which then allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23clnt.c and s23srvr.c...
Denial Of Service (DoS)
OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a long digit string in hex format to trigger an integer overflow, which can cause heap memory corruption or null pointer dereferences that can cause the system to crash...
Improper Resource Shutdown Or Release
Apache Tomcat is vulnerable to Improper Resource Shutdown or Release. The vulnerability is due to improper cleanup of temporary files created during multipart upload processing, which allows an attacker to trigger excessive accumulation of leftover temporary data, potentially exhausting disk spac...
Regular Expression Denial Of Service (ReDoS)
brace-expansion is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient handling of complex or nested patterns in regular expressions within the expand function of the file index.js, allows an attacker to remotely cause excessive resource consumption...
Denial Of Service (DoS)
OpenDaylight Service Function Chaining SFC is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of name resolution or references and allows an attacker to exploit incorrect resolutions to cause a Denial of Service DoS...
Command Injection
llamaindex is vulnerable to Command Injection. The vulnerability is due to insufficient input validation in the safeeval function, allowing attackers to craft inputs that execute arbitrary OS commands without containing underscores, thus bypassing security checks...
Denial Of Service (DOS)
golang.org/x/net is vulnerable to Denial Of Service DoS. The vulnerability is due to a lack of header frame limits, allowing an attacker to send excessive CONTINUATION frames which causes the endpoint to read arbitrary amounts of header data without proper memory allocation limits...
Local File Inclusion
voila is vulnerable to Local File Inclusion. The vulnerability is due to improper handling of file paths within app.py which allows an attacker to access readable files on the server's filesystem...
Server-Side Request Forgery (SSRF)
org.apache.cxf, cxf-rt-databinding-aegis is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due improper URL sanitisation which allows an attacker to perform SSRF attacks on web services that take at least one parameter of any type. Users of other data bindings, including the...
Use After Free
Canvas in Google Chrome is vulnerable to Use after free.The vulnerability is due to referencing memory after it has been freed which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Arbitrary File Read
Jenkins-core is vulnerable to Arbitrary File Read. The vulnerable is due to the command parser improperly substituting the @ character followed by a file path in an argument with the content of the specified file. This flaw allows unauthenticated attackers to read arbitrary files on the Jenkins...
NULL Pointer Dereference
QEMU built-in VNC server is vulnerable to NULL Pointer Dereference. The vulnerability is caused due to qemuclipboardrequest function can be reached before vncservercuttextcaps function is called and had the chance to initialize the clipboard peer. This can lead to NULL pointer dereference allowin...
SQL Injection
jeecg-boot is vulnerable to SQL Injection. The vulnerability is due to improper input validation within the /sys/replicate/check component. This could allow an attacker to inject malicious input leading to SQL Injection...
Denial Of Service (DoS)
openjdk is vulnerable to Denial of Service DoS. The vulnerability applies to Java deployments, primarily clients running sandboxed Java Web Start applications or applets, that load untrusted code e.g., code from the internet and rely on the Java sandbox for security. Successful exploitation can...
Heap-based Buffer Overflow
wireshark is vulnerable to Heap-based Buffer Overflow. The vulnerability is caused due to a component NetScreen file parser which could crash. An attacker can crash Wireshark by injecting a malformed packet onto the wire or making a user to read a malformed packet trace file...
Remote Code Execution
activemq is vulnerable to Remote Code Execution. The vulnerability is due to BaseDataStreamMarshaller.java as there is no class validation and does not verify that the loaded class is a valid Throwable. This allows an attacker to manipulate serialized class types within the OpenWire protocol,...
Out-of-bounds Read
libopensc.so is vulnerable to out-of-bounds reads. The vulnerability exists in card-myeid.c because it does not properly validate symmetric keys, which allows an attacker to send maliciously crafted responses to the APDU and read information outside of the intended range...
Cross-Site Scripting (XSS)
github.com/golang/go is vulnerable to Cross-site Scripting XSS. The vulnerability is due improper handling of "" comment tokens, hashbang "!" comment tokens, in...
Denial Of Service
grpc is vulnerable to Denial Of Service. The vulnerability is due to improper error handling in TCP server which allows an attacker to initiate number of concurrent connections with the server leading to denial of service...
Denial Of Service (DoS)
imagemagick is vulnerable to Denial of Service DoS attacks. The vulnerability exists due to a flaw in the way the identify command handles certain image files. A remote attacker can exploit this vulnerability to cause the ImageMagick process to leak memory, which could eventually lead to a denial...
Information Exposure
mediawiki/core is vulnerable to information exposure. The vulnerability exists due to the lack of rollback page error messages masking in the action=rollback operation of the RollbackAction.php page, which allows an attacker to read a username...
Command Injection
go is vulnerable to Command Injection. The vulnerability allows templates containing actions in unquoted HTML attributes to be executed with empty inputs resulting in unexpected results when parsed potentially leading to allowing injection or arbitrary attributes into tags...
Denial Of Services (DoS)
engine.io is vulnerable to Denial Of Services DoS. The vulnerability exists due to the uncaught exception that occurs in the handleUpgrade function of server.ts and userver.ts when providing an invalid query param, which allows an attacker to crash the application through a maliciously crafted...