Authorization Bypass

werkzeug is vulnerable to Authorization Bypass. A vulnerable browser may allow a compromised application on an adjacent subdomain to set a cookie like =Host-test=bad for another subdomain, when the browser accepts nameless cookies such as =value instead of key=value, resulting in application seei...

Privilege Escalation

linux is vulnerable to privilege escalation. The vulnerability exists due to a double free bug in packetsetring in net/packet/afpacket.c...

Remote Code Execution (RCE)

xstream is vulnerable to remote code execution. The vulnerability exists due to the usage of an insecure default blacklist which does not cover all the excluded XStream security framework...

Remote Code Execution (RCE)

xstream is vulnerable to remote code execution RCE. The vulnerability exists through server-side request forgery when unmarshalling XStream objects with the java.beans.EventHandler, java.lang.ProcessBuilder, javax.imageio.ImageIO$ContainsFilter, and jdk.nashorn.internal.objects.NativeString class...

Remote Code Execution (RCE)

PHPMailer is vulnerable to remote code execution RCE attacks. It is possible because it uses escapeshellcmd which does not properly escape the injected extra parameters through the sendmailSend function. Using this flaw, attackers can inject parameters and launch the execution of arbitrary code...

Open Redirect

follow-redirects is vulnerable to Open Redirect. The vulnerability is due to improper input validation of URL's in the url.parse function. This issue can be exploited by an attacker to redirect users to malicious page leading to information disclosure or phishing attacks...

Remote Code Execution (RCE)

codeigniter4/framework is vulnerable to Remote Code Execution RCE. The vulnerability exists because the Validation.php does not properly validate the validation placeholders, which allows an attacker to inject and execute malicious code...

Access Restriction Bypass

org.springframework.boot:spring-boot-actuator-autoconfigure is vulnerable to Access Restriction Bypass. The vulnerability is due to improper wild card matching, which allows a remote attacker to bypass access restrictions and gain access to the system. Please note that the vulnerability is only...

Privilege Escalation

github.com/minio/minio is vulnerable to Privilege Escalation. An attacker is able to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To achieve this, the attacker needs credentials with arn:aws:s3::: permission and...

Path Traversal

cxf-rt-transports-http is vulnerable to Path Traversal. The vulnerability exists in the handleRequest function of AbstractHTTPServlet.java when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes, allowing an attacker to access any path on the syst...

Privilege Escalation

rh-mysql80-mysql is vulnerable to privilege escalation. A high privileged attacker with network access via multiple protocols to compromise MySQL server, resulting in unauthorized update, insert or delete access to some of MySQL server accessible data...

Regular Expression Denial Of Service (ReDoS)

nth-check is vulnerable to regular expression denial of service. The vulnerability exists due to inefficient regular expression complexity in parse.ts, which may crash the system when parsing a malicious string...

Denial Of Service

python3.9 is vulnerable to denial of service. The vulnerability exists due to an out-of-bounds write vulnerability which allows an attacker to request authentication with a specially crafted payload causing an application crash...

Stored Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization in the dataheadertemplate parameter at the /admin/pages/page endpoint, which allows an attacker to inject and store malicious scripts that execute when the content is rendere...

Arbitrary Code Execution (ACE)

Qiskit is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to unsafe deserialization in the qiskit.qpy.load function, which allows a maliciously crafted QPY file to execute embedded Python code without privilege escalation...

Denial Of Service (DoS)

System.Text.Json is vulnerable to Denial of Service DoS. The vulnerability is due to the JsonSerializer.DeserializeAsyncEnumerable method, which can result in Denial of Service when deserializing crafted input...

Arbitrary Code Injection

Tomcat Catalina is vulnerable to Arbitrary Code Injection. The vulnerability exists in the report function of JsonErrorReportValve.java due to improper escaping of inputs from JsonErrorReportValve which allows an attacker to inject invalid input values...

Remote Code Execution (RCE)

binwalk is vulnerable to remote code execution. A remote attacker is able to upload and execute malicious code on the system under attack via the affected file src/binwalk/modules/extractor.py of the component Archive Extraction Handler...

Insecure Access Control

Apache HTTP Server has insecure access control. The vulnerability exists due to the system not sending the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism...

Authentication Bypass

salt is vulnerable to authentication bypass. The vulnerability exists as the salt-master process fails to properly validate method calls, allowing an attacker to retrieve user tokens and run arbitrary commands on salt minions...

Code Injection

dolibarr/dolibarr is vulnerable to Code Injection. The vulnerability exists when the CMS Website plugin is enabled due to not properly check for different uppercase manipulations of ?php, which allows an attacker to inject and execute arbitrary code into the system...

Arbitrary Memory Write

firefox is vulnerable to Arbitrary Memory Write. An attacker is able to construct a PKCS 12 cert bundle in such a way that may allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled...

XML External Entity (XXE)

xmlbeans is vulnerable to XML External Entity attacks. The vulnerability exists due to the lack of sanitization of XML input containing a reference to an external entity which is processed by a weakly configured XML parser allowing an attacker to exhaust the system resource via recursive external...

Binding Rules Bypass

spring-context is vulnerable to binding rules bypass. The vulnerability exists due to lack of sanitization of HTTP request parameters which allows an attacker to bypass the disallowedFields and bind malicious HTTP request parameters...

Authentication Bypass

tomcat-coyote is vulnerable to authentication bypass. The vulnerability exists as it does not disable AjpProtocol by default, and allows any unauthenticated client to read or write application files on the server...

Buffer Overread

OpenSSL is vulnerable to buffer overreads. A malicious user can pass malicious ASN.1 data to the server, causing a buffer overread which can lead to disclosure of sensitive information or denial of service...

Denial Of Service (DoS)

Temporal Server is vulnerable to Denial of Service DoS. The vulnerability is caused by an authenticated user with permissions to interact with workflows submitting an invalid UTF-8 string which causes an application crash. This can lead to stuck tasks in the queue, increased queue lag, resource...

Credential Exposure

Microsoft.Data.SqlClient is vulnerable to Credential Exposure. The vulnerability is due to improper handling of TLS connections, allowing an attacker to read or modify traffic between the server and client. The attacker would have to position themself between the client and server, resulting in...

Privilege Escalation

grub2 is vulnerable to privilege escalation. A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privileged users to read its content. This represents a low severity confidentiality issue, as those users can...

Use After Free

A vulnerability was found in the vmwgfx driver that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer. Exploiting this vulnerability requires an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and ...

Cross Site Request Forgery (CSRF)

Grafana is vulnerable to cross site request forgery. An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible...

Prototype Pollution

dojo is vulnerable to prototype pollution. The vulnerability exists in setObject function of lang.js due to lack of object validations which allows an attacker to inject arbitrary object properties which can potentially lead to execution of arbitrary code...

Deserialisation Of Untrusted Object

JMSAppender in log4j is vulnerable to deserialization of untrusted object. When an application is configured to use JMSAppender with the setting TopicBindingName or TopicConnectionFactoryBindingName to something that JNDI can handle - for example "ldap://host:port/a", an attacker is able to execu...

Privilege Escalation

tar node-tar is vulnerable to Privilege Escalation. The vulnerability exists due to insufficient absolute path sanitization...

Same-Origin Policy Bypass

firefox is vulnerable to Same-Origin policy bypass. A flaw was found in the way Firefox handled frame objects with certain names. An attacker could use this flaw to cause a plug-in to grant its content access to another site or the local file system, violating the same-origin policy...

Remote Code Execution (RCE)

libxml2.so is vulnerable to remote code execution RCE attacks. The application does not forbid namespace nodes in XPointer ranges, allowing a malicious user to inject and execute arbitrary code...

Server-Side Request Forgery (SSRF)

undici is vulnerable to Server-Side Request Forgery SSRF. The library assumes that the hostname won't change, when in actuality it can change because the specified path parameter is combined with the base URL, allowing remote attackers to cause SSRF attacks via sending a crafted request through t...

OS Command Injection

Apache Spark is vulnerable to OS command injection. The vulnerability exists it is possible to impersonate using an arbitrary user name if ACL is enabled, allowing an attacker to provide malicious input to build and execute a Unix shell command arbitrarily...

Denial Of Service (DoS)

firefox-esr:edge is vulnerable to denial of service. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights...

Prototype Pollution

handlebars is vulnerable to Prototype Pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Remote Code Execution (RCE)

PHP is vulnerable to remote code execution RCE. While using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...

Denial Of Service (DoS)

Apache httpd is vulnerable to denial of serviceDoS attacks. This occurs in modmime when sending a specially crafted Content-Type response header which leads to buffer overread , resulting in a potentially exploitable crash...

Privilege Escalation

Oracle Java SE is vulnerable to privilege escalation attacks. An unspecified vulnerability allows an local users to affect confidentiality, integrity, and availability via vectors related to Hotspot which leads to a denial of service attacks and an information disclosure...

Authorization Bypass

tomcat-catalina is vulnerable to authorization bypass. URL patterns of empty strings were not handled correctly and caused the server to ignore such security constraints when the urlPattern for a servlet is mapped to " ". This allows an attacker to bypass said security constraints and gain...

Out-Of-Bounds Write Vulnerability

MuPDF is vulnerable to an out-of-bounds write vulnerability. A flaw in the glyph scaling code leads to an overwrite of heap metadata and sensitive process memory when an attacker opens a malicious file in a vulnerable reader. This vulnerability also potentially results in code execution...

Privilege Escalation

openssh is vulnerable to Privilege Escalation. The vulnerability arises from the library adding smartcard keys to ssh-agent without enforcing the intended per-hop destination constraints. This can result in unauthorized access to the system and the potential disclosure of sensitive information...

Signature Verification Bypass

thunderbird is vulnerable to Signature Verification Bypass. Certificate OCSP revocation status was not checked when verifying S/Mime signatures which allows mails signed with a revoked certificate to be displayed as having a valid signature...

SQL Injection

sequelize is vulnerable to SQL Injection attacks. A specifically crafted attack statement through query-generator.js allows a malicious user to inject and execute arbitrary SQL queries on the target system due to improper attribute filtering...

Remote Code Execution (RCE)

chakracore is vulnerable to remote code execution. The vulnerability exists through a parsing issue of functions declared in parameter scope, caused in lib/Parser/Parse.cpp. This CVE ID is different from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767...

Open Redirect And Cross-site Scripting (XSS)

django is vulnerable to open redirect and cross-site scripting XSS attacks.The library's security check for redirects considers certain numeric URLs as safe, allowing a malicious user to cause an open redirect or cross-site scripting attack via URL linking...