Lucene search
+L
VeracodeMost viewed

38839 matches found

Veracode
Veracode
•added 2023/08/06 2:34 p.m.•42 views

Remote Code Execution (RCE)

gitlab is vulnerable to Remote Code Execution RCE. The vulnerability exists becuse the library does not properly validate image files, allowing an attacker to inject and execute malicious command through the file parser...

10CVSS7.7AI score0.99731EPSS
SaveExploits29References6Affected Software1
Veracode
Veracode
•added 2023/07/26 10:50 a.m.•42 views

Denial Of Service (DoS)

libvirt.so is vulnerable to Denial of Service. The vulnerability exists in virStoragePoolObjListSearch of virstorageobj.c because it tries to lock the same item from another thread, which causes an application crash...

6.5CVSS6.8AI score0.0076EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
•added 2023/07/14 9:36 a.m.•42 views

Path Traversal

apacheairflow is vulnerable to Path Traversal. The vulnerability exists because the DagRun.runid parameter is not properly sanitized which allows an attacker to gain access to unauthorized files outside the intended directory...

6.5CVSS7AI score0.01787EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/07/13 1:59 p.m.•42 views

Arbitrary Code Execution

restrictedpython is vulnerable to Arbitrary Code Execution. The vulnerability exists because it does not properly restrict access to stack frames and attributes which allows an attacker to access the RestrictedPython environment and create code that receives the current stack frame from a...

9.9CVSS7AI score0.00847EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
•added 2023/07/09 10:29 p.m.•42 views

Heap-Based Buffer Overflow

libjpeg-turbo is vulnerable to Heap-Based Buffer Overflow. A malicious attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples, the application attempting to decompress the image could lead to buffer overflows...

6.5CVSS6.8AI score0.0119EPSS
SaveExploits1References8Affected Software1
Veracode
Veracode
•added 2023/06/20 2:40 a.m.•42 views

Integer Overflow

snappy-java is vulnerable to Integer Overflow. The vulnerability exists because the shuffle functions of BitShuffle.java does not properly check multiplication results if its zero, too small or a negative value or not which cause java.lang.NegativeArraySizeException and...

7.5CVSS10AI score0.01707EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
•added 2023/06/08 9:32 a.m.•42 views

Regular Expression Denial Of Service (ReDoS)

fast-xml-parser is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the readDocType function at DocTypeReader.js which allows an attacker to cause an application crash by submitting an entity name with bad preforming regex because entity names are not sanitize...

7.5CVSS6.7AI score0.01135EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/06/07 7:41 a.m.•42 views

Improper Certificate Validation

org.keycloak:keycloak-services is vulnerable to Improper Certificate Validation. The flaw relies on enabling Revalidate Client Certificate and not validating the reverse proxy before Keycloak. An attacker is able to choose the server-validated certificate, resulting in authentication bypass...

6.5CVSS7AI score0.00425EPSS
SaveExploits0References4Affected Software2
Veracode
Veracode
•added 2023/05/26 5:48 a.m.•42 views

Remote Code Execution (RCE)

System.Drawing.Common is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library does not add the reference count to the graphics metafiles, which allows an attacker to inject and execute malicious code by providing maliciously crafted graphic files. This vulnerabili...

8.1CVSS7.7AI score0.0327EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
•added 2023/05/21 4:19 p.m.•42 views

Denial Of Services (DoS)

libssh.so is vulnerable to Denial Of Services DoS. The vulnerability exists due to a null pointer dereference during rekeying with algorithm guessing, which allows an attacker to cause an application crash when the client initiates rekeying with the firstkexpacketfollows flag in the KEXINIT messa...

6.5CVSS6.7AI score0.01314EPSS
SaveExploits0References12Affected Software2
Veracode
Veracode
•added 2023/05/16 7:02 a.m.•42 views

Authentication Bypass

n8n is vulnerable to Authentication Bypass. The vulnerability is due to a lack of authentication in auth.ts when the url contains .svg, resulting in information disclosure...

7.5CVSS6.6AI score0.01224EPSS
SaveExploits2References6Affected Software1
Veracode
Veracode
•added 2023/05/02 7:04 a.m.•42 views

Denial Of Service (DoS)

dnsmasq is vulnerable to Denial of Service DoS. The vulnerability exists because of the size of the UDP packet exceeds the defaults size which allows an attacker to cause an application crash...

7.5CVSS7.4AI score0.01773EPSS
SaveExploits0References15Affected Software1
Veracode
Veracode
•added 2023/04/28 2:49 a.m.•42 views

Out-of-bounds Write

binutils is vulnerable to Out-of-bounds Write. This vulnerability results in a heap based buffer overflow within 'binutils-gdb/bfd/libbfd.c' in 'bfdgetl64'...

7.8CVSS7.7AI score0.00486EPSS
SaveExploits1References6Affected Software1
Veracode
Veracode
•added 2023/04/19 8:22 a.m.•42 views

Command Injection

net.snowflake:snowflake-jdbc is vulnerable to Command Injection. The vulnerability exists due to improper input sanitizations in the openBrowser function of SessionUtilExternalBrowser.java. An attacker is able to set up a malicious server to respond to an SSO URL with a malicious payload, leading...

8.8CVSS8.8AI score0.01668EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/04/18 6:56 a.m.•42 views

Stored Cross-Site Scripting (XSS)

andrewhaine/silverstripe-form-capture is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of sanitization in form submissions, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

6.1CVSS5.5AI score0.00393EPSS
SaveExploits0References4Affected Software2
Veracode
Veracode
•added 2023/04/06 7:31 p.m.•42 views

Denial Of Service (DoS)

docker is vulnerable to Denial of Service DoS attacks. The injection of arbitrary ethernet frames allow remote attackers to enable denial of service attacks, such as establishing a UDP or TCP connection or smuggling packets into the overlay network...

8.7CVSS7.8AI score0.02559EPSS
SaveExploits1References12Affected Software2
Veracode
Veracode
•added 2023/03/24 12:48 a.m.•42 views

Denial Of Service (DoS)

eap7 is vulnerable to Denial of Service DoS attacks. A denial of service is possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates...

7.5CVSS8.9AI score0.01771EPSS
SaveExploits0References22Affected Software4
Veracode
Veracode
•added 2023/03/15 1:47 a.m.•42 views

Privilege Escalation

github.com/minio/minio is vulnerable to Privilege Escalation. The vulnerability exists in the AddUser and ImportIAM functions of admin-handlers-users.go because a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created...

6.5CVSS6.4AI score0.00898EPSS
SaveExploits1References3Affected Software1
Veracode
Veracode
•added 2023/03/13 5:45 a.m.•42 views

Information Disclosure

Google Chrome is vulnerable to Information Disclosure. The vulnerability exists due to the inappropriate implementation in Paint, which allows an attacker to leak cross-origin data outside an iframe via a crafted HTML page...

4.3CVSS4.9AI score0.00458EPSS
SaveExploits1References3Affected Software1
Veracode
Veracode
•added 2023/03/12 3:00 p.m.•42 views

Denial Of Service (DoS)

vim is vulnerable to Denial Of Service DoS. The vulnerability exists due to the heap-based buffer overflow in the library, which allows an attacker to cause an application crash...

7.8CVSS4AI score0.00555EPSS
SaveExploits1References13Affected Software3
Veracode
Veracode
•added 2023/03/12 9:55 a.m.•42 views

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the Web Payments API, which allows an attacker to compromise the renderer process to potentially exploit heap corruption via a crafted HTML page, leading to an application crash...

8.8CVSS8.7AI score0.00579EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/03/11 9:44 p.m.•42 views

XML External Entity (XXE)

php-dompdf is vulnerable to XML External Entity XXE attacks. SVG images are not processed through Dompdf's resource validation logic, allowing attackers to use remote resources, local filesystem paths, and vulnerable protocols without restriction...

9.8CVSS6.1AI score0.00951EPSS
SaveExploits1References3Affected Software1
Veracode
Veracode
•added 2023/03/10 10:14 p.m.•42 views

Information Disclosure

redmine is vulnerable to Information Disclosure. The library allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user...

7.5CVSS7.1AI score0.00662EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/03/06 5:24 p.m.•42 views

Denial Of Service (DoS)

Linux kernel is vulnerable to Denial Of Service DoS. The vulnerability exists due to the null pointer dereference bug in the traffic control subsystem, allowing an attacker to cause an application crash via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class"...

5.5CVSS6.2AI score0.00964EPSS
SaveExploits1References8Affected Software4
Veracode
Veracode
•added 2023/03/03 7:55 a.m.•42 views

Arbitrary Code Execution

elastic/elasticsearch is vulnerable to Arbitrary Code Execution. The vulnerability exists due to a redirect issue that leads to a user being redirected to an arbitrary website if they use a maliciously crafted kibana url...

6.1CVSS7AI score0.00518EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/02/26 12:22 p.m.•42 views

Denial Of Service (DoS)

github.com/golang/net is vulnerable to Denial of Service DoS attacks. An attacker is able to cause excessive CPU consumption through the HPACK decoder via a small number of maliciously crafted HTTP/2 stream requests, resulting in an application crash...

7.5CVSS7.3AI score0.04561EPSS
SaveExploits0References18Affected Software2
Veracode
Veracode
•added 2023/02/25 8:47 p.m.•42 views

Privilege Escalation

haproxy, buster is vulnerable to Privilege Escalation. An attacker is able to change their resource allocations, promote containers to privileged mode, or potentially add ssh authorized keys to a remote shell on the target machine by creating new files on the host system. In order for an attacker...

9.1CVSS8.7AI score0.05448EPSS
SaveExploits0References10Affected Software4
Veracode
Veracode
•added 2023/01/29 2:53 p.m.•42 views

Denial Of Service (DoS)

bind is vulnerable to Denial of Service DoS. The vulnerability exists because named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota causing an application crash...

7.5CVSS7.5AI score0.16115EPSS
SaveExploits0References6Affected Software3
Veracode
Veracode
•added 2023/01/28 4:49 p.m.•42 views

Denial Of Service (DoS)

bind is vulnerable to Denial of Service DoS. The vulnerability exists because Bind incorrectly handled a large number of UPDATE messages which allows a remote attacker to use this issue to cause Bind to consume resources, resulting in a denial of service...

7.5CVSS7.2AI score0.13213EPSS
SaveExploits0References2Affected Software4
Veracode
Veracode
•added 2023/01/26 8:28 a.m.•42 views

Integer Underflow

openvswitch is vulnerable to integer underflow. The vulnerability exists in Organization Specific TLV which allows an attacker to cause an integer underflow...

9.8CVSS8.7AI score0.01324EPSS
SaveExploits0References6Affected Software5
Veracode
Veracode
•added 2023/01/02 3:16 p.m.•42 views

Cross-Site Scripting (XSS)

iet-ou/open-media-player is vulnerable to cross-site scripting. The vulnerability exists in webvtt function of timedtext.php in the timedtext controller which allows an attacker to inject and execute arbitrary scripts...

5.4CVSS5.8AI score0.00549EPSS
SaveExploits0References8Affected Software1
Veracode
Veracode
•added 2022/12/14 4:47 a.m.•42 views

Cross-Site Scripting (XSS)

loofah is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization data urls in the image/svg+xml parameter in safelist.rb which allows a remote attacker to inject and execute malicious JavaScript into the system...

6.1CVSS6.3AI score0.00792EPSS
SaveExploits0References7Affected Software3
Veracode
Veracode
•added 2022/12/11 5:25 a.m.•42 views

Use After Free

chromium is vulnerable to use after free. The vulnerability exists in dummy buffer which ends up in a window allowing a remote attacker to potentially exploit heap corruption via malicious input...

8.8CVSS8.7AI score0.00486EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
•added 2022/12/05 5:27 a.m.•42 views

Cross-site Scripting (XSS)

nextcloud-desktop is vulnerable to cross-site scripting. An attacker can inject and execute malicious HyperText Markup Language into the Desktop Client application...

6.1CVSS6AI score0.00942EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
•added 2022/11/24 1:35 p.m.•42 views

Remote Code Execution (RCE)

heimdal is vulnerable to remote code execution. The vulnerability exists due to an invalid free in ASN.1 codec which allows an attacker to inject and execute arbitrary codes into the system...

9.8CVSS9.7AI score0.01844EPSS
SaveExploits0References6Affected Software2
Veracode
Veracode
•added 2022/11/23 2:09 a.m.•43 views

Information Disclosure

bc-fips is vulnerable to Information Disclosure. The vulnerability exists because the temporary keys used in the module get zeroed out while still in use by the module, resulting in an error or potential information loss. This vulnerability only affects Java 13 or later...

5.5CVSS5.4AI score0.00431EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
•added 2022/11/19 2:29 p.m.•42 views

Use After Free

linux-azure, linux-aws, linux-gcp, linux-oracle and linux-kvm is vulnerable to Use After Free. The vulnerability exists in mm/mremap.c via a stale tlb because of a rmap lock is not held during a pud move...

7CVSS7AI score0.00469EPSS
SaveExploits1References8Affected Software3
Veracode
Veracode
•added 2022/11/17 4:52 a.m.•42 views

Directory Traversal

rar is vulnerable to Directory Traversal. The vulnerability exists in RARLAB UnRAR which allows an attacker to write to files during an extract aka unpack operation, as demonstrated by creating a /.ssh/authorizedkeys file...

7.5CVSS7.5AI score0.99085EPSS
SaveExploits12References7Affected Software1
Veracode
Veracode
•added 2022/11/10 12:27 a.m.•42 views

Privilege Escalation

rh-mysql80-mysql is vulnerable to privilege escalation. A high privileged attacker with network access via multiple protocols to compromise MySQL server, resulting in unauthorized update, insert or delete access to some of MySQL server accessible data...

5.5CVSS5.4AI score0.01669EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2022/11/06 2:52 p.m.•42 views

Arbitrary Code Execution

nodejs is vulnerable to Arbitrary Code Execution. The vulnerability exists because the IP addresses are not properly handled which allows an attacker to perform DNS rebinding and execute arbitrary code...

8.1CVSS8.2AI score0.1464EPSS
SaveExploits0References8Affected Software3
Veracode
Veracode
•added 2022/11/02 7:00 p.m.•42 views

Denial Of Service (DoS)

qemu is vulnerable to denial of service. The vulnerability exists due to an integer underflow found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload messag...

6.5CVSS6.1AI score0.01237EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2022/10/27 6:47 a.m.•42 views

Arbitrary Code Execution

badaso/core is vulnerable to arbitrary code executions. The vulnerability is due to the application not properly validating the data uploaded by users which allows an attacker to perform arbitrary code execution...

9.8CVSS9.4AI score0.01678EPSS
SaveExploits1References5Affected Software1
Veracode
Veracode
•added 2022/10/25 11:54 p.m.•42 views

Information Disclosure

github.com/free5gc/free5gc is vulnerable to information disclosure. A remote unauthenticated attacker can acquire confidential information of UEs, subscribers and tenants via the webconsole without authentication because it uses the default username Admin, which can be used as a token header...

7.5CVSS7.3AI score0.03066EPSS
SaveExploits1References1Affected Software1
Veracode
Veracode
•added 2022/10/20 3:26 p.m.•42 views

Authorization Bypass

jenkins-2-plugins is vulnerable to Authorization Bypass. The vulnerability exists because of not encoding the ID of input steps when using it to generate URLs which allows an attacker to specify input step IDs and bypass CSRF protection of any target URL...

6.5CVSS7.9AI score0.00472EPSS
SaveExploits0References4Affected Software2
Veracode
Veracode
•added 2022/10/19 5:11 p.m.•42 views

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. The vulnerability exists in mac80211 stack when parsing a multi-BSSID element which allows an attacker to execute arbitrary codes and crash the system...

8.8CVSS8.3AI score0.01279EPSS
SaveExploits1References17Affected Software2
Veracode
Veracode
•added 2022/10/14 11:54 a.m.•42 views

Denial Of Service (DoS)

go is vulnerable to denial of service DoS attacks. A remote attacker is able to allocate unbounded amounts of memory using Reader.Read via passing a maliciously crafted archive, causing a system crash due to resource exhaustion...

7.5CVSS7.4AI score0.01667EPSS
SaveExploits0References14Affected Software13
Veracode
Veracode
•added 2022/10/12 10:01 a.m.•42 views

Remote Code Execution (RCE)

commons-jxpath is vulnerable to remote code execution. The vulnerability exists in selectSingleNode function in JXPathContext.java where the attacker can use the xpath expression to load any java class from the classpath which will lead to a code execution...

3.5AI score
SaveExploits1References2Affected Software1
Veracode
Veracode
•added 2022/10/11 4:25 p.m.•42 views

Arbitrary Code Execution

hermes-engine is vulnerable to arbitrary code execution. The vulnerability exists due to a write-what-where condition caused by an integer overflow in growAndRehash function of CodeBlock.h which allows an attacker to potentially execute arbitrary code via crafted javascript...

9.8CVSS9.6AI score0.00982EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2022/10/10 9:11 p.m.•42 views

Authorization Bypass

modsecurity-crs:sid is vulnerable to authorization bypass. The vulnerability exists due to encoded payload bypass detection, allowing an attacker to cause a specially malicious HTTP Content-Type header field...

9.8CVSS8.7AI score0.01411EPSS
SaveExploits0References10Affected Software1
Veracode
Veracode
•added 2022/09/27 10:47 p.m.•42 views

HTTP Request Smuggling

nodejs-current is vulnerable to HTTP request smuggling. The vulnerability exists due to incorrect parsing header fields in the library, allowing an attacker to smuggle HTTP requests by providing a maliciously crafted input...

6.5CVSS7.8AI score0.02661EPSS
SaveExploits1References5Affected Software3
Total number of security vulnerabilities5000