Spoofing Attack

swagger-ui-react is vulnerable to spoofing attack. The vulnerability allows remote attackers to acquire remote OpenAPI definitions by persuading the victim to open a specifically crafted URL...

XML External Entity (XXE)

liquibase-core is vulnerable to XML external entity attacks. The XMLChangeLogSAXParser function of XMLChangeLogSAXParser.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

Denial Of Service (DoS)

microsoft.aspnetcore.http.features is vulnerable to denial of service. The vulnerability exists in NET 6.0 and .NET 5.0 when kestrel web server processes certain HTTP requests causing an application crash...

Cross-site Request Forgery (CSRF)

github.com/filebrowser/filebrowser is vulnerable to cross-site request forgery. The vulnerability exists due to a lack of validation when creating a user with admin privilege allowing an attacker get access to filesystem via a maliciously crafted HTML webpage...

Denial Of Service (DoS)

webkit2gtk:edge is vulnerable denial of service...

Denial Of Service (DoS)

expat is vulnerable to denial-of-service. The vulnerability exists in storeAtts function in xmlparse.c may lead to realloc misbehavior, allowing a malicious user to cause an application crash...

Cross-site Scripting (XSS)

lxml is vulnerable to Cross-site Scripting XSS. An attacker can inject and execute crafted and SVG embedded scripts through the data URIs in clean.py...

Remote Code Execution (RCE)

nss is vulnerable to remote code execution. The vulnerability exists due to a flaw in the way NSS verifies certificates allowing an attacker to pose as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection...

Improper Input Validation

pip suffers from improper input validation. The library does not properly handle unicode separators in git references. An attacker can use this flaw to install a different revision on a repository...

Denial Of Service (DoS)

linux kernal ipc is vulnerable to denial of service. The vulnerability exists due to a memory overflow in the memcg subsystem which allows a attacker to cause an application crash...

Improper Input Validation

Java SE is vulnerable to improper input validation. An attacker can perform service disruption through the utility component in the oracle GraalVM enterprise edition...

Authentication Bypass

github.com/grafana/grafana is vulnerable to authentication bypass. The library does not properly restrict access to literal paths, allowing unauthenticated users to modify data...

Remote Code Execution (RCE)

ntfs-3g is vulnerable to Remote Code Execution RCE. The vulnerability exists due to a stack buffer overflow...

Privilege Escalation

linux is vulnerable to privilege escalation. The vulnerability exists due to a refcount leak in llcpsockbind causing use-after-free...

Denial Of Service (DoS)

policykit-1 is vulnerable to denial of service. The vulnerability exists due to the system unable to get a unique uid and pid of the process and it cannot verify the privileges of the requesting process...

Directory Traversal

django is vulnerable to Directory Traversal. Lack of path sanitation allows checking of existence of arbitrary files via the use of admindocs TemplateDetailView view by any staff members. Moreover, the default admindocs templates allows developers to customize in such a way that reveals the conte...

Regular Expression Denial Of Service (ReDoS)

ws is vulnerable to regular expression denial of service. An attacker is able to cause excessive CPU consumption that can lead to an application crash by submitting a malicious value of Sec-Websocket-Protocol...

Information Disclosure

kernel is vulnerable to information disclosure. An out-of-bounds speculation on pointer arithmetic in kernel/bpf/verifier.c allows side-channel attacks that defeat Spectre mitigations and allows an attacker to obtain confidential information from kernel memory...

Information Disclosure

postgresql is vulnerable to information disclosure. An attacker can read arbitrary bytes of server memory using the UPDATE ... RETURNING statements on a purpose-crafted partitioned table...

Denial Of Service (DoS)

openssl is vulnerable to denial of service. A NULL pointer dereference occurs when parsing a malicious renegotiation ClientHello message. This allows an attacker to remotely crash the application...

Privilege Escalation

xorg-server is vulnerable to privilege escalation. An attacker is able to obtain additional privileges due to an XkbSetMap Out-Of-Bounds Access Privilege Escalation Vulnerability...

Remote Code Execution (RCE)

drupal is vulnerable to remote code execution RCE. The vulnerability exists as it does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. It is possible due to Red Hat only CVE-2020-12351 regression, allowing a remote attacker in an adjacent range to crash the system...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. A null pointer dereference in drivers/scsi/qla2xxx/qlaos.c allows an attacker to crash the kernel...

Cross-Site Scripting (XSS)

dompurify is vulnerable to cross-site scripting XSS. A mutation XSS vulnerability exists as a serialize-parse roundtrip does not return the original DOM tree, causing a namespace change from HTML to MathML via FORM elements...

Information Disclosure

webkitgtk4 is vulnerable to information disclosure. The vulnerability exists through the lack of validation, causing a race condition condition that allows reading of restricted memory...

Arbitrary Code Execution

webkitgtk4 is vulnerable to arbitrary code execution. The vulnerabiltiy exists through memory errors...

Arbitrary Code Execution

webkitgtk4 is vulnerable to arbitrary code execution. The vulnerability exists through parsing web content to memory corruption...

Arbitrary Code Execution

WebKitGTK+ is vulnerable to arbitrary code execution. Processing maliciously crafted web content may lead to arbitrary code execution...

Open Redirection

Squid is vulnerable to Open Redirection. When certain web browsers are used, HTML in the hostname parameter is mishandled to cachemgr.cgi...

Spoofable Frames

linux is vulnerable to spoofable network frames. The vulnerability exists through the reinstallation of the Integrity Group Temporal Key IGTK during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients...

Arbitrary Code Execution

squid3 is vulnerable to arbitrary code execution. The vulnerability exists as squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer, that allows encoded URLs to bypass the urlregex check...

Denial Of Service (DoS)

github.com/golang/go is vulnerable to denial of service. An infinite read loop in ReadUvarint and ReadVarint allows an attacker to create a denial of service condition via malicious input...

Authorization Bypass

mariadb is vulnerable to authorization bypass. The vulnerability exists through high privileged attacker with network access via multiple protocols...

Arbitrary Code Execution

activesupport is vulnerable to arbitrary code execution. The vulnerability exists as the user input written to the cache store using the raw: true parameter can cause the cached code to be evaluated when read again...

Information Disclosure

kernel is vulnerable to information disclosure. An L2 guest may trick the L0 hypervisor to access confidential L1 resources...

Remote Code Execution (RCE)

udp.c in the Linux kernel is vulnerable Remote Code Execution RCE. It allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSGPEEK flag...

Arbitrary Code Execution

sqlite is vulnerable to arbitrary code execution. The vulnerability exists as the getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. A use-after-free vulnerability in blkaddtrace in kernel/trace/blktrace.c allows an attacker to crash the system...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as the I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw to gather confidential information, such as the length of a password used in a process...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. A NULL pointer dereference flaw was found in the way the Linux kernel's key management facility handled user-defined key types. A local, unprivileged user could use the keyctl utility to cause a denial of service...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a non-member VLAN virtual LAN packet handling for interfaces in promiscuous mode and also using the be2net driver could allow an attacker on the local network to cause a denial of service...

Denial Of Service (DoS)

firefox and thunderbird are vulnerable to denial of service. A flaw was found in the way Thunderbird handled malformed JPEG images. An HTML mail message containing a malicious JPEG image could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user runni...

Arbitrary Code Execution

thunderbird/firefox is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML content. Malicious HTML content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a missing validation check was found in the Linux kernel's macpartition implementation, used for supporting file systems created on Mac OS operating systems. A local attacker could use this flaw to cause a denial of servic...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as the flaw in sctpprocessunkparam, allowing a remote attacker to send a specially-crafted SCTP packet to an SCTP listening port on a target system, causing a denial of service...

Arbitrary Code Execution

freetype is vulnerable to arbitrary code execution. The vulnerability exists through an array index error was found in the way the FreeType font rendering engine processed certain PostScript Type 42 font files. If a user loaded a specially-crafted font file with an application linked against...

Privilege Escalation

java is vulnerable to privilege escalation. An unspecified vulnerability allows an attacker to affect confidentiality, integrity and availability of the system via unknown vectors...