Remote Code Execution (RCE)

microsoft.chakracore is vulnerable to remote code execution. ProxyEntryPointInfo causes out-of-bound writes or arbitrary code being executed. This CVE ID is different from CVE-2018-8353, CVE-2018-8355, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390...

Cache Timing Side-Channel Attack

openssl is vulnerable to cache timing side-channel attacks. The vulnerability exists due to the lack of constant time comparison during the RSA key generation of p and q, resulting in the potential ability to recover the private key...

Denial Of Service (DoS)

ImageMagick is vulnerable to denial of service DoS attacks. A malicious user can pass a WPG image file to the application, causing a heap allocation error that can crash the application...

Regular Expression Denial Of Service (ReDoS)

struts2-core and xwork-core are vulnerable to regular expression denial of service ReDoS attacks. When the URLValidator is used it is possible to overload the server process through an attacker controlled URL. These attacks are as a result of an incomplete fix for CVE-2017-7672...

Denial Of Service (DoS)

ImageMagick is susceptible to denial of service DoS attacks. The vulnerability is caused due to not properly handling memory allocation in the formatIPTC method in coders/meta.c...

Denial Of Service(DoS) Via CPU Consumption

WordPress is vulnerable to denial of service DoS attacks. The attacks exist because the hashing of large passwords are not properly handled, leading to high CPU usage...

Heap-based Buffer Over-read

ImageMagick is vulnerable to heap-base buffer over-reads. The flaw in the TIFFWriteScanline function in tifwrite.c can be triggered through a file being processed in convert...

Unauthorised Metadata Modification

Moodle is vulnerable to unauthorised metadata modification. The vulnerability exists due to a flaw in mod/assign/externallib.php which does not filter the function parameters, allowing modification of the grade metadata information...

Heap-based Buffer Overflow Through Embedded C Dependency

nokogiri has a copied version of the libxml2 library. The copy that nokogiri includes is vulnerable to heap-based buffer overflow due to an incomplete fix for CVE-2016-1839. The buffer overflow is caused due to a flaw in the xmlDictAddString function in dict.c. This vulnerability in libxml2 is...

Denial Of Service (DoS)

expat is vulnerable to denial of service DoS attacks, with the possibility of other attacks. The vulnerability exists because there are multiple integer overflows in the XMLGetBuffer function that leads to a heap-based buffer overflow which may lead to further unspecified impact. CVE-2016-4472 is...

Remote Code Execution (RCE)

ffmpeg is vulnerable to remote code execution RCE. Wrong usage of strtoll in the httpreadstream function in http.c passes a negative chunksize in chunk encoding. Therefore, it leads to a buffer overflow allocated next to the AVIOContext structure which eventually causes rip control and then code...

Information Disclosure

OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug during the montgomery squaring procedure. This makes it easier for a malicious user to obtain sensitive private key information from the Diffie-Hellman Ciphersuite as the attack can be conducted offline...

Denial Of Service (DoS) Through Memory Consumption

OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible due to a memory leak in the dtls1bufferrecord function which can be triggered by sending duplicate records for the next epoch...

Denial Of Service (DoS) Through Null Pointer Dereference

OpenSSL is vulnerable to denial of service DoS attacks through a null pointer dereference and daemon crash. This is because there is an unexpected handshake during the unsupported protocols. NOTE: this issue became relevant after the CVE-2014-3568 fix...

Denial Of Service (DoS) Through Out-of-bounds Heap Access

FFMpeg is vulnerable to denial of service DoS attacks and possibly other attacks. These attacks are possible because the mjpegdecodeapp function allows out-of-bounds heap access through vectors relating to LJIF tags in an MJPEG file...

Information Diclosure

bouncycastle is vulnerable to timing attacks. Due to the lack of blinding, a malicious user can monitor the time taken to generate a signature to gain information about the signatures k value and eventually the private value...

XML External Entity (XXE)

Apache CXF JAX-RS is vulnerable to XML eternal entity XXE attacks. The Atom MessageBodyReaders use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk...

SQL Injection

langchain-ai/langchain is vulnerable to SQL injection. The vulnerability is due to insufficient input validation in the GraphCypherQAChain class, which allows user-controlled inputs to be embedded in SQL queries without proper sanitization...

OS Command Execution

HFS is vulnerable to OS Command Execution. The vulnerability is due to using execSync instead of spawnSync in a childprocess to execute the df shell command, which allows an attacker to execute OS commands remotely via the file upload feature...

Cross-Site Scripting (XSS)

froxlor/froxlor is vulnerable to Cross-Site Scripting. The vulnerability is due to inadequate sanitization of user input in the loginname parameter during failed login attempts, which allows attackers to inject and store malicious scripts that are executed when an administrator views the System...

Biased ECDSA Nonce Generation

PuTTYis vulnerable to biased ECDSA nonce generation. The vulnerability is due to biased ECDSA nonce generation, allowing an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is particularly significant in scenarios where an adversary can re...

Sensitive Information Disclosure

GnuTLS is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exploiting deterministic behavior in systems like GnuTLS, particularly when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, which can lead to a noticeable step in nonce size from 513 to 512 bits, exposing a...

NULL Pointer Dereference

Libvirt is vulnerable to NULL pointer dereference. The vulnerability is caused by a race condition due to the simultaneous detachment of a host interface while collecting the list of interfaces using the virConnectListAllInterfaces API. This race condition leads to a situation where the path...

Improper Preservation Of Permissions

Apache Airflow is vulnerable to Improper Preservation of Permissions. This vulnerability is caused due to Airflow's local file task handler incorrectly setting permissions for parent folders of the log folder, potentially granting unintended group write access...

Denial Of Service (DoS)

io.netty: netty-codec-http is vulnerable to Denial Of Service DoS. The vulnerability is due to missing form field restrictions within the HttpPostRequestDecoder class. An attacker can send a chunked POST request with many small form fields, possibly resulting in Denial of Service DoS...

Information Disclosure

Apache Camel is vulnerable to Information Disclosure. The vulnerability is due to improper validation for EventFactory implementations and the handling of ExchangeCreatedEvent instances. This flaw allows attackers to craft malicious EventFactory instances and provide custom ExchangeCreatedEvent...

Denial Of Service

jetty-http is vulnerable to Denial Of Service DoS. The vulnerability is due to GOAWAY frames failing to be written to the queue when there is TCP congestion within the server. An attacker can exploit idle timeout periods to leave HTTP/2 or 3 connections in the ESTABLISHED state, even when they...

Insecure Deserialisation

clearml is vulnerable to Insecure Deserialisation. The vulnerability is due to Deserialisation of untrusted data. An attacker can upload a malicious pickle file via the project API to run arbitrary code on an end user's system...

Missing Entitlement Check

github.com/moby/buildkit is vulnerable to Missing Entitlement Check. The vulnerability due to improper validation of the security.insecure entitlement flag within the BuildKit APIs. An attacker can run a malicious container with elevated permissions as a result of this flaw...

Expired Pointer Dereference

squid is vulnerable to Expired Pointer Dereference. The vulnerability is due to the usage of a pointer after dereference. An attacker can exploit this vulnerability to mount a Denial Of Service DOS attack against Cache Manager error responses when generating error pages for Client Manager reports...

Cross Site Scripting (XSS)

jinja2 is vulnerable to Cross Site Scripting XSS. The vulnerability is due the xmlattr filter accepting keys containing spaces. The attacker can inject arbitrary HTML attribute keys and values, which would potentially lead to XSS...

Cross-Site Scripting

cacti is vulnerable to Cross-Site Scripting. The vulnerability is due to in templatesimport.php When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, potentially leads to XSS...

SQL Injection

Cacti is vulnerable to SQL Injection. The vulnerability is due to a lack of input sanitization in pollers.php script. This allows an attacker to potentially execute malicious SQL code, resulting in a SQL injection...

Denial Of Service

libtiff.so is vulnerable to Denial Of Service attack. The vulnerability is due to a lack of codec validation in the tiffcp utility. A heap based buffer overflow is caused while processing a crafted TIFF file, leading to Denial of Service DoS...

Use After Free

Google Chrome is vulnerable to Use After Free. The vulnerability exists in the Garbage Collection process, potentially allowing an attacker to exploit heap corruption via a maliciously crafted HTML page...

Arbitrary Code Execution

The PostgreSQL is vulnerable to Arbitrary Code Execution. The vulnerability is caused due to missing overflow checks during SQL array value modification. This can lead to an authenticated database user write arbitrary bytes to memory and extensively read the server's memory by exploiting an integ...

Denial Of Service

libnbd is vulnerable to Denial of Service DoS. The vulnerability is due to a flaw in the handling of 64-bit extended headers in the NBD protocol when dealing with large flag values in the server's reply to the NBDCMDBLOCKSTATUS command...

Cross-site Scripting (XSS)

chromium is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the inappropriate implementation in Payments, which allows an attacker to bypass XSS preventions via a malicious file...

Path Traversal

samba is vulnerable to Path Traversal. An attacker could exploit this vulnerability by creating a malicious file with a specially crafted path and then uploading the file to a Samba share. When a user downloads the file, the Samba server will resolve the path to the file on the underlying...

Path Traversal

Go is vulnerable to Path Traversal attack. On Windows, function clean can transform an invalid path to a valid path. This transformation of a relative path to absolute path could enable a directory traversal attack...

Denial Of Service (DoS)

Golang.org/x/net is vulnerable to Denial of Service DoS. This vulnerability exists due to a flaw which allows a user to send a request, and quickly cancel it. The http2.Server.MaxConcurrentStreams limits the amount of allowed inflight requests, but does not handle the situation of resetting the...

Denial Of Service (DoS)

wireshark is vulnerable to Denial of Service DoS. A memory leak in the RTPS dissector allows a remote attacker to cause a denial of service DoS attack by sending a specially crafted RTPS packet...

Server Side Request Forgery (SSRF)

torchserve is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused by a missing input validation check in the default configuration for the property value of allowedurls, which is used to restrict URLs used to load the PyTorch model in the application. This can lead to an...

Information Disclosure

openjdk8 is vulnerable to Information Disclosure. An attacker can access the vulnerable library through the multiple network and gain read access to the subset of Oracle Java SE, Oracle GraalVM Enterprise Edition and Oracle GraalVM...

Remote Code Execution (RCE)

exim is vulnerable to Remote Code Execution RCE. The vulnerability arises from the absence of proper validation for user-supplied data in the SMTP service. This could result in a buffer overflow, enabling an attacker to inject and execute malicious code within the service account's context...

Insecure Temporary Files

org.jenkins-ci.main: jenkins-core is vulnerable to Insecure Temporary Files. The vulnerability is caused by not restricting permissions to the temporary file in the system temporary directory and leaving the newly created files with default permissions which are created by the Jenkins API...

HTTP Request Smuggling

Jetty is vulnerable to HTTP Request Smuggling. The vulnerability is due to accepting + character proceeding the content-length in the request. This vulnerability can be exploited by the attacker to possibly conduct request smuggling attacks...

Denial Of Service (DoS)

binutils is vulnerable to Denial of Service DoS attacks. The vulnerability exists in the loadseparatedebugfiles function in the dwarf2.c file. The function is responsible for loading debug information from separate ELF files. The vulnerability occurs when the function fails to properly check the...

SQL Injection

postgresql is vulnerable to SQL injection. This vulnerability occurs when a user sends a specially crafted query that uses the @extowner@ function. If the query is valid, PostgreSQL could be tricked into executing arbitrary SQL code...

Denial Of Service (DoS)

mariadb is vulnerable to Denial of Service DoS attacks. The vulnerability occurs when MariaDB attempts to print a warning message for a query that fails. If the query contains a NULL value, MariaDB could dereference a NULL pointer and crash...