39640 matches found
Denial Of Service Through Integer Overflow
OpenSSL has denial of service through integer overflow vulnerability. The vulnerability is caused due to the use of externally supplied data for SIZE bytes for memory allocation, thereby allowing malicious user to cause heap/memory corruption...
Unsafe Encryption Scheme
bouncycastle allows for the use of electronic code book ECB mode with Elliptical Curve Integrated Encryption Scheme ECIES. The use of ECB is generally unsafe because it is susceptible to replay attacks...
Remote Code Execution (RCE)
RESTEasy is vulnerable to remote code execution. SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy uses SnakeYAML and enables the yaml provider by default, under certain conditions, RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of...
CRLF Injection
undici is vulnerable to CRLF Injection. The vulnerability is due to undici not validating the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher, where an attacker can inject CRLF sequences and append arbitrary HTTP headers,...
Uncontrolled Resource Consumption (Denial Of Service)
PhpSpreadsheet is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the OLE reader following attacker-controlled sector chains without detecting cycles or enforcing a maximum chain length, which allows an attacker to upload a specially crafted .xls/OLE...
Improper Authorization
Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks on the asset request cancellation endpoint, where user-controlled URL parameters can specify another user's pending request, allowing authenticated attackers to cancel asset requests...
Regular Expression Denial Of Service (ReDoS)
minimatch is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to nested extglob patterns generating regex with unbounded quantifiers, which allows an attacker to trigger catastrophic backtracking via crafted patterns and inputs, leading to significant performance...
Security Sandbox Bypass
getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to insufficient protection of the Twig template sandbox, which allows an authenticated user with editor permissions to inject malicious template directives and execute arbitrary code on the server...
Cross-site Scripting (XSS)
Liferay Portal is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization due to the message boards feature allowing remote authenticated attackers to inject malicious JavaScript via the web interface...
Insecure Deserialization
huggingface transformers is vulnerable to Insecure Deserialization. The vulnerability is due to the ability to load arbitrary pickle files from other repos specified by the indexpath while parsing the remote config.json fille. An attacker can exploit this flaw to execute arbitrary code on the...
External Control Of File Name Or Path
h2o is vulnerable to External Control of File Name or Path. The vulnerability exists due to improper input validation which allows an attacker to manipulate file paths to access or modify files outside of the intended directories...
CRLF Injection
aiohttp is vulnerable to CRLF Injection attack. The vulnerability arises due to improper HTTP version validation in aiohttp/clientreqrep.py. An attacker can preform CRLF injection if they have the ability to modify the HTTP version in the request header...
HTTP Request Smuggling
aiohttp is vulnerable to HTTP Request Smuggling. The vulnerability exists due to various issues with header parsing in httpparser.py. This allows a remote attacker to smuggle an HTTP request by submitting a maliciously crafted header. This is impactful when AIOHTTPNOEXTENSIONS is enabled or when...
Man-in-the-Middle (MitM)
open-vm-tools is vulnerable to Man-in-the-Middle MitM attacks. This vulnerability can be exploited by an attacker with man-in-the-middle MITM network positioning between vCenter and the ESXi host hosting the virtual machine to bypass SAML token signature verification, to perform VMware Tools Gues...
Denial Of Service (DoS)
github.com/golang/go is vulnerable to Denial Of Service DoS. The vulnerability exists because handshakeclient.go does not set a max RSA key size, which can lead to extremely large RSA keys in certificate chains causing a client to expend significant CPU time to verify signatures. The fix sets the...
Denial Of Service (DoS)
snappy-java is vulnerable to Denial Of Service DoS. The vulnerability exists because the hasNextChunk function of SnappyInputStream.java does not properly check for negative chunk sizes and huge positive values such as 0x7FFFFFFF, which leads to java.lang.NegativeArraySizeException and...
Insecure Handling Of Strict-Transport-Security Header
qt6-qtbase is vulnerable to Insecure Handling of Strict-Transport-Security Header. The vulnerability occurs because Qt Network incorrectly parses the Strict-Transport-Security HSTS header, which can result in unencrypted connections being established even when the server explicitly prohibits them...
Path Traversal
ghost is vulnerable to Path Traversal. The vulnerability exists because the static-theme.js does not properly sanitize file paths, which allows an attacker to access files outside the expected directory and read arbitrary files within the active theme's folder via relative paths such as...
Double Free
curl is vulnerable to Double Free. Two threads sharing the same HSTS data could end up doing a double-free or use-after-free due to missing mutexes or thread locks. This was introduced without consideration for sharing across separate threads, which could lead to a double-free or use-after-free...
Remote Code Execution (RCE)
SPIP is vulnerable to Remote Code Execution RCE. The vulnerability exists because of the improper sanitization of form values in the public area, allowing an attacker to inject and execute malicious code...
Authorization Bypass
snort is vulnerable to authorization bypasses. An unauthenticated, remote attacker may exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit allows the attacker to bypass the configured file policies and deliver a malicious...
Denial Of Service (DoS)
log4j:log4j is vulnerable to Denial of Service DoS attacks. The vulnerability is due to the Chainsaw or SocketAppender components processing a logging entry with either a deeply nested hashmap or hashtable, which can lead to memory exhaustion when the object is deserialized. An attacker can submi...
Information Disclosure
xen is vulnerable to Information Disclosure. AMD processors may speculatively execute instruction from a sibling thread after a SMT mode switch leading to information disclosure...
Denial Of Service (DoS)
go is vulnerable to Denial of Service DoS. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files, causing the application to crash...
Remote Code Execution
shopware is vulnerable to Remote Code Execution RCE. An attacker with access to a Twig environment is able to use templates to call any global PHP function with filters such as map, filter, and sort, which allows an attacker to upload and execute malicious code on the system...
Denial Of Service (DoS)
ruby-nokogiri is vulnerable to denial of service DoS attacks. The library fails to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Readerattributehash which may lead to a null pointer exception when invalid markup is being parsed, causing denial of service conditions...
Cross-Origin Resource Sharing (CORS)
quarkus-vertx-http is vulnerable to an insecure cross-origin resource sharing CORS policy. The vulnerability exists because the XMLHttpRequest has no event listeners registered on the object returned by the XMLHttpRequest upload property, allowing an attacker to send malicious GET and POST reques...
Denial Of Service (DoS)
Linux Kernel is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the l2capreassemblesdu function in l2capcore.c which allows an attacker to cause an application crash...
Remote Code Execution (RCE)
quarkus-vertx-http is vulnerable to remote code execution. The vulnerability exists in multiple functions due to drive-by localhost attacks which allows an attacker to inject and execute malicious query parameters via the Dev UI Config Editor...
Server-side Request Forgery (SSRF)
moodle/moodle is vulnerable to server-side request forgery. An attacker can make HTTP requests to untrusted URLs through the send function of HTTPMessage.php and gain access to sensitive information through the LTI provider library...
Denial Of Service (DoS)
libtasn1.so is vulnerable to Denial Of Service DoS. The vulnerability exists in struct tagandclassst function of init.h due to an ETYPEOK off-by-one array size check which allows an attacker to crash the application via malicious input...
Remote Code Execution
HyperSQL Database is vulnerable to remote code execution. The vulnerability exists in the supportsJavaMethod function of HsqlDatabaseProperties.java due to the untrusted input process allowing an attacker to execute remote codes in the system...
Denial Of Service (DoS)
github.com/golang/net is vulnerable to Denial Of Service DoS. The vulnerability exists in goAway function in server.go because the server errors are not properly handled which allows an attacker to cause an application crash...
Privilege Escalation
ansible is vulnerable to privilege escalation. A remote authenticated attacker with change user permissions is able to modify the account settings of the superuser account and/or remove the superuser privileges...
Remote Code Execution (RCE)
activerecord is vulnerable to Remote Code Execution RCE. Active Record uses YAML.unsafeload to convert the YAML data in to Ruby objects allowing an attacker who can manipulate data in the database to execute malicious code remotely...
Heap-based Buffer Overflow
vim is vulnerable to heap-based buffer overflow. The vulnerability exists because the lisp indenting does not check for NULL earlier which causes an overflow...
Authorization Bypass
shiro-core is vulnerable to authorization bypass. The vulnerability exists due to the case-insensitive regex pattern matching used in the matches function of RegExPatternMatcher.java, allowing an attacker to bypass the servlet container when RegExPatternMatcher with . in the regular expression...
Use After Free
kernel is vulnerable to use after free. The vulnerability exists due to a memory corruption in the hsofreenetdevice function of drivers/net/usb/hso.c which allows an attacker to escalate their privileges on the system...
Denial Of Service (DoS)
Apache HTTP Server is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization with modsed in contexts where the input to modsed may be very large, modsed may make excessively large memory allocations and trigger an abort...
Out-of-Bounds Read
Apache HTTP Server is vulnerable to out of bounds read. The vulnerability exists due to a memory corruption when configured to process requests with the modisapi module...
Denial Of Service (DoS)
libtiff is vulnerable to denial of service. The vulnerability exists due to a buffer overflow in the "invertImage" function in the component "tiffcrop" allowing an attacker to crash the system via the "invertImage"...
Timing Attack
firefox-esr is vulnerable to timing attack. An attacker allows to send a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals...
Privilege Escalation
njs is vulnerable to privilege escalation. The vulnerability exists in njspromiseperformthen function due to a type confusion which allows an attacker to gain access to the system and perform unauthorized actions...
Server-side Request Forgery (SSRF)
github.com/hoppscotch/proxyscotch is vulnerable to server-side request forgery. When the interceptor mode is set to proxy, An attacker can make HTTP requests to untrusted URLs through the main function of server.go and gain access to sensitive information...
Privilege Escalation
libarchive is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation of the access control list ACL when extracting a maliciously crafted link...
Privilege Escalation
openjdk is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation of authorization allowing an attacker to gain unauthorized access to critical data or complete access to all Oracle Java SE...
Sensitive Information Disclosure
Jenkins Pipeline is vulnerable to sensitive information disclosure. It allows attackers with Item/Read permission to retrieve the default password parameter value from jobs. A flaw was found in Jenkins pipeline-build-step where it revealed password parameter default values when generating a...
Improper Access Control
calibreweb is vulnerable to improper access control. The vulnerability exists because the server doesn't properly validate the user permissions when rendering HTML containing shelf name which allows an attacker to gain access to names of all private shelves...
Insecure Access Control
linux is vulnerable to insecure access control. The vulnerability exists due to a flaw in kvms390guestsidaop in the arch/s390/kvm/kvm-s390.c function in KVM allowing an attacker to obtain unauthorized memory write access...