38839 matches found
Spoofing Attacks
moodle/moodle is vulnerable to spoofing attacks. The vulnerability exists in the getremoteaddr function in moodlelib.php, allowing an attacker to spoof a user's IP through the X-Forwarded-For headers, bypassing the remote address checks...
Denial Of Service (DoS)
chrome is vulnerable to denial of service. The vulnerability exists due to a use after free in WebGPU in Google Chrome allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Out-of-bounds Write
vim:sid is vulnerable to denial of service. The vulnerability exists due to an out-of-bounds write in GitHub repository...
SQL Injection
oliverklee/seminars is vulnerable to SQL injection. Lack of sufficient sanitisation of input query to EventBagBuilder::limitToOrganizers and EventBagBuilder::limitToCategories allows an attacker to inject malicious SQL query...
Use-After-Free
qemu is vulnerable to use-after-free. The vulnerability exists in USB EHCI controller emulation because EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets which allows an attacker to cause an application crash...
Information Disclosure
opensshkeyparser is vulnerable to information disclosure. The vulnerability exists in readfixedbytes function in pascalstylebytestream.py because the exception message is not properly handled which allows an attacker to gain access to view and modify the length of a raw field value of a key...
Insecure Cryptography
ujson is vulnerable to insecure cryptography. The vulnerability exists in a JSON string contains escaped surrogate characters which are not part of a proper surrogate pair, the library may decode those characters incorrectly which allows remote attackers to cause unintended behavior in the...
Integer Overflow
thunderbird and firefox are vulnerable to integer overflow. The vulnerability exists in ReplaceElementsAt function because the number of elements to replace was too large for the container causing an integer overflow which then leads to an application crash...
Session Fixation
silverstripe/hybridsessions is vulnerable to session fixation. The vulnerability exists because the destroy function of DatabaseStore.php does not properly reset the user session after logging out, allowing an attacker to gain privileges via the client-side cookie...
Denial Of Service (DoS)
MariaDB is vulnerable to denial of service. The vulnerability exists due to a deadlock indsxbstream.cc, crashing the system when an error occurs streamctxt-destfile == NULL while executing the method xbstreamopen...
Remote Code Execution (RCE)
grub2 is vulnerable to remote code execution. The vulnerability exists due to a heap out-of-bounds write that happen during the handling of Huffman tables in the PNG reader allowing an attacker to inject malicious code into the system via a crafted PNG image...
Out-of-Bounds Read
Apache HTTP Server is vulnerable to out of bounds read. The vulnerability exists due to a lack of sanitization of the aprwrite function allowing an attacker to cause the server to reflect very large input using aprwrite or aprputs, such as with modluas r:puts function...
Buffer Overflow
php is vulnerable to buffer overflow. The vulnerability exists due to a memory corruption which allows an attacker to cause an overflow...
Privilege Escalation
Linux kernel is vulnerable to privilege escalation. The vulnerability exists due to an out of bounds read due to a use after free allowing an attacker to escalate privilege within the system...
Cross-Site Scripting (XSS)
total.js is vulnerable to stored cross-site scripting. The vulnerability exists in upload function due to lack of sanitization which allows an attacker to execute arbitrary javascript via a javascript embedded PDF file...
Denial Of Service (DoS)
pjproject is vulnerable to denial of service. The vulnerability exists due to the library does not properly check the WAV file data length when it greater than 31-bit, allowing an attacker to crash the application by providing malicious WAV files...
Host Header Injection
craftcms/cms is vulnerable to host header injection. The vulnerability exists due to the lack of validation in the password reset token in processInvalidToken function of UsersController.php, allowing an attacker with valid email addresses or account names to manipulate the password reset...
Denial Of Service (DoS)
libxml2.so is vulnerable to denial of service. The xmlBufCreateSize function of buf.c does not properly check types of buffer sizes, allowing an attacker to crash the application by providing large multi-gigabyte buffers...
Memory Leak
qemu is vulnerable to a memory leak. The vulnerability exists in virtio-net device of qemu where it forgets to unmap the cached virtqueue element on error where a malicious privileged guest could exploit this issue to crash qemu within the context of the qemu process on the host...
Cross-Site Scripting (XSS)
Liferay Layout SEO Web is vulnerable to stored cross-site scripting. The vulnerability exists in getOpenGraphTag function in OpenGraphTopHeadDynamicInclude.java due to lack of html escaping which allows an attacker to inject and execute arbitrary javascript...
Remote Code Execution (RCE)
ghost is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the upload and update function allowing an attacker inject maliciously crafted script via an SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is...
Path Traversal
studio-42/elfinder is vulnerable to path traversal. The vulnerability exists due to improper handling of absolute file paths in the getFullPathfunction. allowing a remote attacker to access data in the system...
Denial Of Service (DoS)
.NET and Visual Studio are vulnerable to denial of service. The vulnerability exists due to a lack of sanitization allowing an attacker to crash the system...
Side-Channel Attacks
hostapd is vulnerable to side channel attack. The vulnerability exists due to cache access patterns...
Buffer Overflow
pjproject is vulnerable to buffer overflow. The vulnerability exists due to a stack overflow in PJSUA API when calling pjsuaplayercreate...
Denial Of Service (DoS)
github.com/istio/istio is vulnerable to Denial Of Service DoS. The vulnerability exists because the library does not properly limit the reads from untrusted inputs, allowing an attacker to crash the application by providing maliciously crafted messages...
Insecure HTTP2 TrustManager
spring-cloud-gateway-server uses an insecure HTTP2 TrustManager. Application with default configuration and no key store or trusted certificates uses an insecure trustmanager factory option when HTTP2 is enabled, allowing the gateway connections to remote services with invalid or custom...
Use After Free
chromium is vulnerable to use after free. The vulnerability exists in Optimization Guide which allows an attacker to cause a memory corruption...
Validation Bypass
github.com/cri-o/cri-o is vulnerable to Validation Bypass. When an attacker creates a pod with a hostIPC and hostNetwork kernel namespace, the attacker is able to apply sysctls from the list of safe sysctls specified for the cluster resulting in unauthorized access due to insufficient validations...
Directory Traversal
firefox is vulnerable to directory traversal. The vulnerability exists due to a Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary directory. This bug only affects Firefox on Windows. Other operating systems ar...
Denial Of Service (DoS)
github.com/golang/go is vulnerable to Denial Of Service DoS. The vulnerability exists due to uncontrolled memory consumption in SetString function which allows an attacker to crash the application by providing a malicious input...
Denial Of Service (DoS)
vim is vulnerable to denial of service. The vulnerability exists due to a heap-based buffer overflow which allows an attacker to cause an application crash...
Injection Vulnerability
Python is vulnerable to injection vulnerability. The vulnerability exists due to a lack of sanitization on the URL string parsed into the urlparse method allowing an attacker to inject maliciously crafted URL...
Authorization Bypass
Google Chrome is vulnerable to authorization bypass. This is because the insufficient policy enforcement in background fetch in prior to 96.0.4664.45 allows a remote attacker to bypass same origin policy via a crafted HTML page...
SQL Injection
johnpbloch/wordpress-core is vulnerable to sql injection. The vulnerability exists due to the lack of sanitization in the WPMetaQuery , allowing an attacker to inject and execute malicious SQL queries to the DB...
Cross-site Scripting (XSS)
mermaid is vulnerable to cross-site scripting. The vulnerability exists in the sanitizeUrl function in the svgDraw.js, allowing an attacker to inject and execute malicious javascript through the malicious diagrams...
Denial Of Service (DoS)
libexpat.so is vulnerable to denial of service. The vulnerability exists due to the integer overflow in the mgroupSize of xmlparse.c, allowing an attacker to cause an application crash...
Denial Of Service (DoS)
python3 is vulnerable to denial of service. The vulnerability exists because the ftplib is using the host from the PASV response which allows an attacker to cause an application crash...
Remote Code Execution (RCE)
WinSCP is vulnerable to remote code execution. The vulnerability exists because it does not prevent loading of session settings which allows an attacker to trigger a remote code execution via malicious URLs...
Denial Of Service (DoS)
kernel-rt is vulnerable to denial of service DoS attacks. A flaw out of bounds memory access in the Linux kernel bluetooth subsystem was found in the way when some data being read about the bluetooth device with the hciextendedinquiryresultevt call. A local user could use this flaw to crash the...
Cross-Site Scripting (XSS)
ckeditor4 is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of HTML in the Advance Content Filter ACF module which allows an attacker to inject maliciously crafted HTML containing Javascript code...
Denial Of Service (DoS)
kernel is vulnerable to Denial Of Service DoS. An Access Point AP forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and make...
Privilege Escalation
glib2 is vulnerable to privilege escalation. The vulnerability exists due to the use of random charset alias and lack of sanitization of the authorization, leaking content from files owned by privileged users to unprivileged ones under the right condition...
Use-After-Free
busybox is vulnerable to use-after-free vulnerability. A remote unauthenticated attacker could craft an awk pattern and send to the evaluate function resulting in a system hang...
Denial Of Service (DoS)
tensorflow is vulnerable to denial of service DoS. The vulnerability exists because the API can be made to deadlock when two tf.function functions are mutually recursive by using Lock Python object, allowing an attacker to crash the application by calling a recursive tf.function...
Directory Traversal
chrome is vulnerable to directory traversal. The vulnerability exists due to Insufficient validation of untrusted input Downloads...
Improper Input Validation
Java SE is vulnerable to Improper Input Validation. An attacker can perform service disruption through the Hotspot component in the oracle GraalVM enterprise edition...
Denial Of Service (DoS)
linux-oracle:hirsute is vulnerable to denial of service. The decodedata function in drivers/net/hamradio/6pack.c in the Linux kernel has a slab out-of-bounds write. Input from a process that has the CAPNETADMIN capability can lead to root access...
Denial Of Service (DoS)
linux is vulnerable to denial of service. The vulnerability exists due to an out-of-bounds OOB memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel...
HTTP Request Smuggling
puma is vulnerable to HTTP request smuggling. Incorrect handling of HTTP requests with LF characters as line endings, allows a remote attacker to smuggle a request through a proxy, causing the proxy to send a response back to the victim...