Denial Of Service (DoS)

openjdk is vulnerable to denial of service. An unexpected exception thrown by XPathParser processing malicious XPath expression allows an attacker to crash the application...

Denial Of Service (DoS)

OpenJDK is vulnerable to denial of service DoS. The attack exists because it does not perform glyph bitmap image dimension check in FreetypeFontScaler...

Denial Of Service (DoS)

OpenJDK is vulnerable to denial of service DoS. The vulnerability exists through an unexpected exception thrown by XPath processing crafted XPath expression...

XML External Entity (XXE)

DiffPlug Spotless is vulnerable to XML external entities XXE. The XML formatter has resolveExternalURI setting to true by default and it loads external DTD...

Denial Of Service (DoS)

nginx HTTP/2 is vulnerable to denial of service DoS. It does not prevent the attacker from creating multiple request streams and flooding using PRIORITY frames continuously in a way that causes substantial churn to the priority tree, causing an excessive resource consumption...

Arbitrary Code Execution

libcurl.so is vulnerable to arbitrary code execution. A heap-based buffer overflow in the function tftpreceivepacket that receives data from a TFTP server could potentially allow an attacker to execute arbitrary code by sending an OACK without the BLKSIZE option, when a BLKSIZE smaller than 512...

Information Disclosure

php is vulnerable to information disclosure. An uninitialized read in the function exifprocessIFDinMAKERNOTE due to mishandling of the datalen variable allows an attacker to read past allocated buffer and potentially obtain confidential information...

Denial Of Service (Dos)

php is vulnerable to denial of service. An out-of-bounds read due to integer overflow in the function iconvmimedecodeheaders can lead to information disclosure or allow an attacker to crash the application...

Remote Code Execution (RCE)

microsoft chakracore is vulnerable to remote code execution. The vulnerability exists through a JIT type confusion attack in lib/Backend/GlobOptIntBounds.cpp...

Directory Traversal

LibreOffice is vulnerable to directory traversal. Arbitrary python functions in arbitrary modules on the filesystem can be executed without warning...

Unauthorised Access

github.com/kubernetes/kubernetes is vulnerable to unauthorised access to the resources. API server allows a user with access privilege to the custom resources in one namespace to create, view update or delete the cluster-scoped resources...

Remote Code Execution (RCE)

Microsoft ChakraCore is vulnerable to remote code execution. This could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, potentially taking over the system with full user rights...

Denial Of Service (DoS)

expat is vulnerable to denial of service DoS. The attack exists because XML parser does not validate and handle the XML names input with large number of colons, consuming high CPU and memory...

Information Disclosure

Undertow Core is vulnerable to information disclosure. Confidential information such as HTTP Authentication for HttpServerExchange object at ERROR level are logged in plain text using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange by Connectors.executeRootHandler:402...

Cross-site Scripting (XSS)

tomcat-catalina is vulnerable to cross-site scripting XSS. The vulnerability is possible because it outputs unsanitized user provided data for SSI printenv, allowing the attacker to inject arbitrary script through it...

Sandbox Protection Bypass

Jenkins Script Security Plugin is vulnerable to sandbox protection bypass vulnerability. This exists in the src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java which allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint...

Authorization Bypass

Linux kernel is vulnerable to authorization bypass attacks. This is because net/netfilter/nfnetlinkcthelper.c function does not require the CAPNETADMIN capability for new, get, and del operations. This allows local users to bypass intended access restrictions...

Privilege Escalation

Linux kernel is vulnerable to privilege escalation vulnerability. The vulnerability exists in the xc2028setconfig function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel. Local users could cause a denial of service via vectors involving omission of the firmware name from a certain dat...

Denial Of Service (DoS)

Apache httpd is vulnerable to denial of serviceDoS attacks. A remote user could send a specially crafted sequence of request headers to trigger a buffer overread error in apfindtoken and cause a segmentation fault which leads application to a crash...

Denial Of Service (DoS)

zlib is vulnerable to denial of service attacks. A remote user is able to cause an application crash resulting in denial of service conditions. The vulnerability affects the function inflateMark in the library zlib of the file inflate.c...

Null Pointer Dereference

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...

Directory Traversal

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...

Privilege Escalation

Oracle MySQL, MariaDB, Percona Server and Percona XtraDB Cluster are vulnerable to privilege escalation. A locally authenticated attacker may use race condition while setting stats during MyISAM table repair to obtain elevated privileges...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Insufficient Entropy In Key Generation Algorithm

The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by...

Sensitive Information Leakage

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic acce...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php54 packages provide a recent stable release of PHP with the PEAR 1.9.4, APC 3.1.15, and memcache 3.0.8 PECL extensions, and a number of additional utilities. The php54 packages have been upgraded to...

Arbitrary File Write

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php55 packages provide a recent stable release of PHP with the PEAR 1.9.4, memcache 3.0.8, and mongo 1.4.5 PECL extensions, and a number of additional utilities. The php55 packages have been upgraded to...

Denial Of Service (DoS)

mysql is vulnerable to denial of service DoS. The vulnerability exists as remotely authenticated users can affect the availability through Server : InnoDB...

Arbitrary Code Execution

Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. It was discovered that the unhtmlify function o...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrar...

Sensitive Information Disclosure

OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. The following security issues are addressed with this release: An authorization flaw was discovered in Kubernetes; the API server did not...

Information Disclosure

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java...

Denial Of Service (DoS)

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...

Denial Of Service (DoS)

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...

Sandbox Protection Bypass

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause t...

Buffer Overflow

The X11 Xorg libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol da...

Denial Of Service (DoS)

The kernel packages contain the Linux kernel, the core of any Linux operating system. A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol SCTP implementation handled simultaneous connections between the same hosts. A remote attacker could u...

Denial Of Service (DoS)

The kernel packages contain the Linux kernel, the core of any Linux operating system. A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol SCTP implementation handled simultaneous connections between the same hosts. A remote attacker could u...

Weak Authentication

The Network Time Protocol NTP is used to synchronize a computer's time with a referenced time source. Multiple buffer overflow flaws were discovered in ntpd's cryptorecv, ctlputdata, and configure functions. A remote attacker could use either of these flaws to send a specially crafted request...

Denial Of Service (DoS)

Kerberos is vulnerable to denial of service DoS. If a KDC served multiple realms, certain requests could cause the setupserverrealm function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request...

Arbitrary Code Execution

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Authorization Bypass

java is vulnerable to authorization bypass. The vulnerability exists through Scripting...

Use-After-Free

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Information Disclosure

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Privilege Escalation

Perl is a high-level programming language commonly used for system administration utilities and web programming. A heap overflow flaw was found in Perl. If a Perl application allowed user input to control the count argument of the string repeat operator, an attacker could cause the application to...

Heap-Based Buffer Overflow

mingw32-libxml2 is vulnerable to a heap-based buffer overflow. Due to a flaw in libxml2 which decods entity references with long names, it allows an attacker to provide a malicious XML file, causing an application crash and arbitrary code execution...

Privilege Escalation

IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security...