Denial Of Service (DoS)

samba is vulnerable to denial of service DoS attacks. The vulnerability exists as all versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the inpu...

Denial Of Service (DoS)

qemu-kvm is vulnerable to denial of service DoS attacks. The vulnerability exists as the mode4and5 write functions in hw/display/cirrusvga.c in Qemu allow local OS guest privileged users to cause a denial of service out-of-bounds write access and Qemu process crash via vectors related to dst...

Denial Of Service (DoS)

qemu-kvm-rhev is vulnerable to denial of service DoS attacks. The vulnerability exists as QEMU aka Quick Emulator, when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service out-of-bounds read and QEMU process crash via vectors involving...

Privilege Escalation

Linux kernel is vulnerable to privilege escalation. A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. As a result of the race the nex...

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service heap memory corruption via an...

Privilege Escalation

github.com/opencontainers/runc is vulnerable to privilege escalation attacks. These attacks are possible because github.com/opencontainers/runc treats a numeric UID as a potential username. This allows local users to gain privileges though a numeric username in the password file. This transitivel...

Arbitrary Code Execution

Apache commons-collections is vulnerable to arbitrary code execution. It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code wi...

Authorization Bypass

modjk is vulnerable to authorization bypass attacks. The vulnerability exists as Apache Tomcat Connectors modjk before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS attacks. The vulnerability exists as the 1 piperead and 2 pipewrite implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local...

Denial Of Service (DoS)

php is vulnerable to denial of service DoS attacks. The vulnerability exists as the scan function in ext/date/lib/parseisointervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service heap-based buffer...

Remote Code Execution (RCE)

bash is vulnerable to remote code execution RCE attacks. The vulnerability exists as GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrate...

Information Disclosure Through Buffer Over-read

OpenSSL is vulnerable to information disclosure. OpenSSL does not correctly handle Heartbeat Extension packets, attackers can leverage this flaw to read sensitive information by triggering a buffer over-read. This is also known as Heartbleed...

Remote Code Execution (RCE)

httpd is vulnerable to remote code execution RCE. The modrewrite.c in the modrewrite module does not sanitize non-printable characters before writing to a log file, allowing a remote attacker to inject escape sequences for a terminal emulator into the log file via an HTTP request, resulting in...

Information Disclosure

OpenSSL is vulnerable to information disclosure. This is possible because the SSL protocol 3.0 uses a nondeterministic CBC padding allowing attackers to perform man-in-the-middle MitM attacks. This is also known as the POODLE issue...

XML External Entity (XXE) To Read Files

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity XXE injection attack...

Denial Of Service (DoS)

glibc is vulnerable to denial of service DoS attacks. The vulnerability exists through a buffer overflow issue in the extendbuffers function in the regular expression matcher posix/regexec.c in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service memor...

Authorization Bypass

PHP is vulnerable to authorization bypass. File names with NULL characters \0 are not properly handled, which would allow a remote attacker to abuse the vulnerability to create a PHP script to access arbitrary files and bypass file system access restrictions. This is demonstrated by entering a NU...

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service through a crafted application...

HTTP Request Smuggling

Apache Tomcat is vulnerable to HTTP request smuggling. Incorrect handling of HTTP requests allows a remote attacker to poison the web cache, bypass web application firewall protections or perform XSS attacks. The vulnerability is exploited by submitting crafted values for the Transfer-Encoding an...

Session Hijacking

tomcat-util is vulnerable to session hijacking attacks. The vulnerability exists due to tomcat-util incorrectly treating single quotes as delimiters in cookies, allowing sensitive information such as session ID to be leaked. This issue is also CVE-2007-3385...

Denial Of Service (DoS)

libtiff.so is susceptible to denial of service DoS. The vulnerability is possible because the ChopUpSingleUncompressedStrip function allocates memory without considering the size of the file, leading to the attack if a malicious TIFF file is input. This CVE is different from CVE-2018-15209...

Same Origin Policy Bypass

libcurl.so is vulnerable to same origin policy bypass. This is due to the libcurl's cookie parser having no public suffix awareness, which could allow for cookies to be set for arbitrary sites by setting a cookie for a top-level domain...

Denial Of Service (DoS)

tomcat-util is vulnerable to denial of service DoS attacks. The attack exists due to not proper handling of overflow in the decodeHasArray function in UTF-8 decoder...

Remote Code Execution (RCE)

spring-data-commons is vulnerable to remote code execution RCE attacks. The vulnerability exists due to the improper sanitization of special elements that can be used as gadgets to achieve remote code execution RCE when evaluated...

Denial Of Service (DoS)

Apache poi is vulnerable to denial of service DoS attacks. Attackers can cause infinite loops, when parsing WMF, EMF, MSG and macro files. They can also cause Out-of-Memory OOM exceptions to occur when parsing DOC, PPT and XLS files...

Remote Code Execution (RCE)

lucene-queryparser is vulnerable to remote code execution RCE. This is possible through the use of an XML external entity expansion XXE attack and the Config API with add-listener command...

Remote Code Execution (RCE)

github.com/golang/go is vulnerable to remote code execution RCE. If custom domains are used, a malicious user can set a domain example.com/proj1 to point to a subversion repository and another domain example.com/proj1/proj2 to point to a git repository. When the go get command is run, arbitrary...

SQL Injection

Moodle is vulnerable to SQL injection attacks. The attacks exist because the application does not filter null bytes \0 characters in query strings, leading to SQL statements failing and causing error to the Microsoft SQL driver. This can allow a malicious user to inject and execute SQL queries...

Database Activity Preset Overwrites

Moodle is vulnerable to database activity presets being overwritten. Authenticated users are able to leverage a flaw when iterating arrays to overwrite database activity presets...

Timing Attack

jasypt is vulnerable to timing attacks. The attacks are possible because it uses Arrays.equals to verify passwords with different lengths, thereby revealing the time taken to compare the passwords...

XML External Entity (XXE)

Glassfish web-core is vulnerable to XML External Entity XXE attacks. These allow remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference. This is relate...

Remote Code Execution (RCE) Via Deserialization Of Untrusted Data

spring-flex-core is vulnerable to remote code execution RCE via deserialization of untrusted data. The vulnerability is possible because it has a flaw in the AMF3 deserialization using the java.io.Externalizable class instances. This allows attackers to request a Remote Method Invocation RMI remo...

Directory Traversal

ImageMagick is vulnerable to directory traversal. The library does not escape relative paths, allowing a malicious user to upload an arbitrary module into the system...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks and possibly other attacks. A malicious user can pass a reused session ticket to the system that can cause a double free that can lead to the system crashing...

Chain Certificate Forgery

OpenSSL is vulnerable to chain certificate forgery. A malicious user can bypass the certificate verification process, enabling the user to use a valid leaf certificate and "issue" an invalid certificate...

Denial Of Service (DoS)

FFmpeg is vulnerable to denial of service DoS attacks and possibly other attacks. A malicious user can pass a malicious WebM file to create race conditions in the system that can lead to the system crashing...

Information Disclosure

OpenSSL is vulnerable to information disclosure. When pretty printing through the OBJobj2txt function in crypto/objects/objdat.c is it possible for attackers to read from the process stack memory. This is caused because OpenSSL does not ensure the presence of \0 characters...

Denial Of Service (DoS) Through Null Pointer Dereference

OpenSSL is vulnerable to denial of service DoS attacks. This is caused by the sslsetclientdisabled function and triggered by a ServerHello message that includes an SRP ciphersuite but no negotiation of that suite with the client...

Information Disclosure

OpenSSL is vulnerable to padding oracle attacks. A malicious user can use an SSLv2 server as a Bleichenbacher oracle, allowing the malicious user to decrypt TLS ciphertext data...

XML External Entity (XXE)

Apache CXF JAX-RS is vulnerable to XML eternal entity XXE attacks. The Atom MessageBodyReaders use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk...

Improper Authentication

github.com/edgelesssys/contrast is vulnerable to Improper Authentication. The vulnerability is due to unauthenticated LUKS2 volume metadata and support for null key-encryption algorithms, which allows an attacker to craft a malicious volume that opens with any passphrase and captures all written...

Cross-site Scripting (XSS)

modx/revolution is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper file validation due to authenticated users being able to upload SVG files containing malicious JavaScript, which executes in victims' browsers when viewing the profile image...

Path Traversal

WebMvc.fn and WebFlux.fn are vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user input in handling file paths, allows attackers to craft requests that bypass security restrictions and access unauthorized files on the server...

Cross-Site Scripting (XSS)

prestashop/prestashop is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the customer thread feature allowing malicious file uploads through the front-office contact form. When an admin opens the attached file in back office, arbitrary JavaScript will be executed which can...

JWT Exposure

@valtimo/components is vulnerable to JWT Exposure. The vulnerability is due to a misconfiguration of the Form.io component, which exposes the user's access token JWT to api.form.io via the x-jwt-token header, allowing attackers to retrieve personal information or execute requests to the Valtimo...

Arbitrary Code Execution

ipython is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper origin validation of websocket requests, allowing remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page...

Reachable Assertion

libbind9.so is vulnerable to an assertion failure during recursive resolution. The vulnerability is due to a bad interaction between DNS64 and serve-stale features when both are enabled. This can potentially leads to Denial of service...

OS Command Injection

OpenSSH is susceptible to an OS command injection flaw because it fails to adequately validate user names or host names that include shell metacharacters. This flaw enables attackers to exploit these names through an expansion token in certain scenarios, such as when a submodule in an untrusted G...

Stack Overflow

Ion Java is vulnerable to Stack Overflow. The vulnerability is due to improper validation while deserializing Ion text encoded data, or deserializing Ion text or binary encoded data into an IonValue model. This issue can be exploited by an attacker via crafted malicious Ion data, resulting in...

Denial Of Service

asterisk:sid is vulnerable to denial of service. The vulnerability due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. It allows an attacker can be done continuously, thus denying new DTLS-SRTP encrypted calls which can leads to denia...