39270 matches found
Authentication Bypass
moodle/moodle is vulnerable to authentication bypass. The vulnerability exists in the userlogin function of auth.php due to a type juggling, which allows an attacker to access restricted domains via the external database authentication...
Memory Leak
bind is vulnerable to memory leak. By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources...
Heap-buffer-overflow
binutils, edge is vulnerable to a heap buffer overflow. The vulnerability exists in bfdgetl32 function when called from the stripmain function in strip-new via a malicious file...
Information Disclosure
thunderbird is vulnerable to information disclosure. An attacker can gain sensitive information when composing a response to an HTML email with a META refresh tag...
Denial Of Service (DoS)
.NET Core is vulnerable to denial of service. The vulnerability exists due to a stack overflow which allows an attacker to send a customized payload that is parsed during model binding and cause an application crash...
Improper Input Validation
chromium is vulnerable to improper input validation. The vulnerability exists due to the library does not properly validate user input in Intents...
Denial Of Service (DoS)
mariadb is vulnerable to denial of service DoS attacks. The vulnerability is in the subselect function where the attacker is able to remotely cause denial of service conditions due to a segmentation fault in the above mentioned function...
Privilege Escalation
ansible is vulnerable to privilege escalation. A remote authenticated attacker with change user permissions is able to modify the account settings of the superuser account and/or remove the superuser privileges...
Denial Of Service (DoS)
moodle/moodle is vulnerable to denial of service. The vulnerability exists because the yuicombo.php does not properly limit the path length, allowing an attacker to crash the application by loading a large number of files...
Denial Of Service (DoS)
vim is vulnerable to denial of service. The vulnerability exists due to the use after free in the library, allowing an attacker to crash the application by providing a malicious input...
Denial Of Service (DoS)
chrome is vulnerable to denial of service. The vulnerability exists due to a use after free in WebGPU in Google Chrome allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Out-of-Bounds Read
vim is vulnerable to out-of-bound reads. Vulnerability exists in the msgouttransspecial function in message.c to cause an out-of-bounds read that can crash the application...
Out-of-bounds Write
vim:sid is vulnerable to denial of service. The vulnerability exists due to an out-of-bounds write in GitHub repository...
Directory Traversal
rsync is vulnerable to Directory Traversal. The vulnerability exists due to a lack of validation of file names allowed, allowing a malicious rsync server or Man-in-The-Middle attacker to overwrite arbitrary files in the rsync client target directory and subdirectories...
Heap-Buffer Overflow
lua5.4 is vulnerable to heap-buffer overflow. The vulnerability exists in the component luaGrunerror when a recursive error occurs which allows an attacker to cause an application crash...
Denial Of Service (DoS)
sqlite3 is vulnerable to Denial Of Service DoS. The vulnerability exists because the whereKeyStats routine is unable to cope with row-value comparisons against the primary key index of a WITHOUT ROWID table which allows an attacker to cause an application crash...
Information Disclosure
bolt is vulnerable to information disclosure. The vulnerability exists in the startplan function in connection.rb due to submitting sensitive parameter values to the orchestrator service when running plans over the PCP transport which allows an attacker to gain access to sensitive information...
Type Confusion
chromium is vulnerable to type confusion. A remote attacker is able to exploit a heap memory corruption issue via a crafted HTML page, which leads to a use-after-free state in V8 module...
Privilege Escalation
git is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation of user inputs which allows an attacker to access the git repository perform unauthorized actions...
SQL Injection
oliverklee/seminars is vulnerable to SQL injection. Lack of sufficient sanitisation of input query to EventBagBuilder::limitToOrganizers and EventBagBuilder::limitToCategories allows an attacker to inject malicious SQL query...
Spoofing Attacks
firefox and thunderbird are vulnerable to spoofing attacks. The vulnerability exists because a pop-up window could be resized to overlay the address bar with web content, resulting in potential user confusion or spoofing attacks...
Regular Expression Denial Of Service (ReDoS)
org.apache.tika:tika is vulnerable to regular expression denial of service ReDoS attacks. An attacker is able to cause denial of service conditions to the users who are running the StandardsExtractingContentHandler component, due to an insecure regular expression usage in setThreshold function by...
Information Disclosure
guzzlehttp/guzzle is vulnerable to information disclosure. The vulnerability exists in serveral functions in RedirectMiddleware.php because the change in port is not considered a change in origin when sending requests with header files which allows an attacker to gain access to sensitive header...
Insecure Signature Verification
jsrsasign is vulnerable to insecure signature verification. The vulnerability exists because the library does not properly validate the JWS or JWT signature with non-Base64URL encoding special characters or number escaped characters such as !@$% or \11...
Information Disclosure
vim is vulnerable to information disclosure. Buffer over-read in the currentquote function allows local attackers to cause information disclosure...
Information Disclosure
vim is vulnerable to information disclosure. A buffer over-read in function grabfilename is capable of crashing the software, memory modification, and possible remote execution...
Information Disclosure
@finastra/nestjs-proxy is vulnerable to information disclosure. The vulnerability exists in the ProxyService function due to a lack of sanitization in the authorization header which allows an unauthorized user to access sensitive information in the system...
Command Injection
github.com/hashicorp/go-getter is vulnerable to command injection. The vulnerability exists in clone function in gethg.go due to improper handling of user input which allows an attacker to inject and execute arbitrary commands...
Denial Of Service (DoS)
firefox is vulnerable to denial of service. The vulnerability exists due to incorrect assembly generation on arm64 leading to a register allocation problem which causes an application crash...
Heap-based Buffer Overflow
tensorflow is vulnerable to heap-based buffer overflow. The use of AllocatedBytes in the insecure hash function AbslHashValue allows local authenticated attackers to cause heap-based buffer overflows resulting in denial of service conditions...
User Impersonation Via Anonymous Access
github.com/argoproj/argo-cd is vulnerable to user impersonation. An attacker is able to send an invalid JSON Web Token JWT along with a request if anonymous access to the Argo CD instance is enabled, allowing an unauthenticated user to get access with same privilege, create, manipulate and delete...
Cross-Site Scripting (XSS)
total.js is vulnerable to stored cross-site scripting. The vulnerability exists in upload function due to lack of sanitization which allows an attacker to execute arbitrary javascript via a javascript embedded PDF file...
Information Disclosure
curl is vulnerable to information disclosure.libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies...
Out-of-bound Reads
linux is vulnerable to out-of bound reads. The vulnerability exists in drivers/usb/gadget/udc/udc-xilinx.c because the endpoint index is not validated and might be manipulated by the host for out-of-array access...
Denial Of Service (DoS)
pjproject is vulnerable to denial of service. The vulnerability exists due to the library does not properly check the WAV file data length when it greater than 31-bit, allowing an attacker to crash the application by providing malicious WAV files...
Improper Access Control
github.com/golang/go is vulnerable to improper access control. An attacker is able to access unauthorized files in the file system because, the Faccessat function may incorrectly grant permissions to access a prohibited file when called with a non-zero flag parameter...
Host Header Injection
craftcms/cms is vulnerable to host header injection. The vulnerability exists due to the lack of validation in the password reset token in processInvalidToken function of UsersController.php, allowing an attacker with valid email addresses or account names to manipulate the password reset...
SQL Injection
mediawiki/core is vulnerable to sql injection. The vulnerability exists due to insecure quote handling in the getAllOrValues function in SDAppliedFilter.php allows an attacker to inject arbitrary queries...
Cross-Site Scripting (XSS)
Liferay Layout SEO Web is vulnerable to stored cross-site scripting. The vulnerability exists in getOpenGraphTag function in OpenGraphTopHeadDynamicInclude.java due to lack of html escaping which allows an attacker to inject and execute arbitrary javascript...
Access Control Bypass
ceph is vulnerable to access control bypass. The vulnerability exists due to a flaw which allows key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks...
Open Redirect
next-auth is vulnerable to open redirect. The vulnerability exists in redirect function in default-callbacks.ts due to the lack of url validation which allows an attacker to parse malicious urls to redirect the user...
Denial Of Service (DoS)
github.com/golang/text is vulnerable to Denial Of Service DoS. The vulnerability exists because an incorrectly formatted language tag may cause the parse to panic due to an out of bounds read, resulting in an application crash...
Denial Of Service (DoS)
libxml2 is vulnerable to denial of service. The vulnerability exists due to an integer overflow in xmlmemory.c...
Remote Code Execution (RCE)
laravel/laravel is vulnerable to remote code execution. The vulnerability exists in destruct in PendingResourceRegistration.php, Manager.php, and ClosureWrapper.php which allows an attacker is able to inject malicious code via an unserialize pop chain...
Symlink Attack
github.com/beego/beego is vulnerable to symlink attack. Lack of sufficient check for the existence of files created allows an attacker to use MemProf and GetCPUProfile commands to trigger the symbolic link attack locally...
HTTP Request Smuggling (HRS)
twisted is vulnerable to http request smuggling. The vulnerability exists in twisted.web due to inconsistent interpretation of http requests which allows a remote attacker to conduct HTTP request smuggling attacks via a crafted request...
Denial Of Service (DoS)
RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...
Path Traversal
studio-42/elfinder is vulnerable to path traversal. The vulnerability exists due to improper handling of absolute file paths in the getFullPathfunction. allowing a remote attacker to access data in the system...
Denial Of Service (DoS)
Apache is vulnerable to denial of service. The vulnerability exists because a carefully crafted request body can cause a read to a random memory area which could cause the process to crash...