39248 matches found
Sandbox Escape
Jinja2 is vulnerable to sandbox escapes. Users are allowed to input str.format through web templates, leading to an escape from sandbox. This CVE is related to CVE-2019-10906...
Cross-Site Request Forgery (CSRF)
wordpress is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it does not have any CSRF protections in place to prevent forged request when posting comments. Moreover, a lack of comment content filtering when an administrative user posts a comment, allows a remote attack...
Remote Code Execution (RCE)
railties is vulnerable to remote code execution. A remote attacker is able to guess the automatically generated secret token when Rails is in development mode. This token can subsequently be used in combination with other Rails internals to execute arbitrary code...
Cross-Site Scripting (XSS)
nexus-core is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the repoId and format parameters of the healthCheckFileDetail function, the file name in the File Upload functionality of Staging Upload, the username when...
Denial Of Service
libpoppler.so is susceptible to denial of service DoS. The lack of proper memory handling for negative XRef indices in the function XRef::getEntry in XRef.cc leads to huge integer overflow, allowing an attacker to crash the process using a malicious PDF input to pdftocairo...
Denial Of Service (DoS)
nginx is vulnerable to denial of service. An attacker is able to cause a infinite loop or a memory disclosure in ngxhttpmp4module via a malicious mp4 file...
Information Disclosure
Linux kernel that is built with CONFIGPOSIXTIMERES and CONFIGCHECKPOINTRESTORE is vulnerable to information disclosure. An out-of-bounds access in the showtimer function in the timercreate syscall implementation in kernel/time/posix-timers.c allows userspace applications to read arbitrary kernel...
Information Disclosure
Linux kernel is vulnerable to information disclosure. The FPU state information is disclosed in a lazy FPU restore, which would allow a local process to determine information from another process through a specilative execution side channel...
Remote Code Execution (RCE)
github.com/golang/go is vulnerable to remote code execution RCE. If custom domains are used, a malicious user can set a domain example.com/proj1 to point to a subversion repository and another domain example.com/proj1/proj2 to point to a git repository. When the go get command is run, arbitrary...
Remote Code Execution (RCE)
Supervisor is vulnerable to remote code execution RCE attacks. A malicious user can send a malicious XMLRPC request to the application to inject and execute arbitrary commands at daemon level privilege...
Denial Of Service (DoS)
kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the pivotroot implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service...
Denial Of Service (DoS)
ghostscript is vulnerable to denial of service DoS attacks. The vulnerability exists as the memgetbitsrectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted PostScript document...
User Deletion Via Incorrect Permissions Check
keycloak-services is vulnerable to user deletion through an incorrect permissions check. A malicious user that has access to a service account can delete users in a seperate realm...
Denial Of Service (DoS)
gstreamer-plugins-bad-free is vulnerable to denial of service DoS attacks. The vulnerability exists as an integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service crash via large width and height values, which triggers a buffer overflow...
Cross-site Scripting (XSS) Via Dialog CloseText
jquery-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can execute arbitrary code to the closeText parameter of the dialog function...
Denial Of Service (DoS)
bind is vulnerable to denial of service DoS attacks. The vulnerability exists as named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service assertion failure and daemon exit via a DNAME record in the answer...
Regular Expression Denial Of Service (ReDoS) Via Long String Of Semicolons
tough-cookie is vulnerable to regular expression denial-of-service ReDoS attack. A malicious user can pass a long string that contains many semicolons in the Set-Cookies header, causing a regular expression to take a large amount of time, causing a denial of service condition...
Denial Of Service (DoS)
spice-server is vulnerable to denial of service. A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash t...
Man-in-the-Middle (MitM)
nss is vulnerable to man-in-the-middle attack. A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could...
Authorization Bypass
samba is vulnerable to authorization bypas. An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path...
Denial Of Service (DoS)
qemu-kvm-rhev is vulnerable to denial of service. It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and the payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of servi...
Denial Of Service (DoS)
qemu-kvm is vulnerable to denial of service. A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance denial of service or...
Cookie Leak
libcurl.so is vulnerable to cookie leak. A remote attacker is able to set or send arbitrary cookies for certain sites. libcurl.so parses IP addresses similar to domain names, where a site with an IP address of 192.168.0.1 can set or send cookies for another site ending with .168.0.1...
Denial Of Service
The kernel-rt packages is vulnerable to denial of service DoS attack. The attack exists because it does not properly restrict the traversal of Rock Ridge extension Continuation Entries CE, allowing a local attacker to cause an infinite loop in the kernel, resulting in a denial of service...
Authorization Bypass
httpd24-httpd is vulnerable to authorization bypass attacks. The vulnerability exists as the modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding...
Arbitrary File Access Using A Symlink Attack
rack/file.rb Rack::File in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATHINFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka 'symlink path...
Arbitrary Code Execution Through REST API Call
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...
Denial Of Service (DoS)
firefox is vulnerable to denial of service DoS attacks. The vulnerability exists through multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a...
Information Disclosure
jboss is vulnerable to information disclosure attacks. The vulnerability exists as twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...
Remote Code Execution (RCE)
php is vulnerable to remote code execution RCE attacks. The vulnerability exists through a format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information memory contents and possibly execute arbitrary cod...
Timing Side- Channel Attack
OpenSSL is vulnerable to timing attacks. It happens because of lack of validation of MAC addresses in constant time during the processing of a malformed CBC padding. It is also known as "Lucky Thirteen" issue...
Man-in-the-Middle (MitM)
OpenSSL is vulnerable to man in the middle MitM attacks. These attacks are possible because an attacker can force OpenSSL to use a zero-length master key. This allows attackers to hijack sessions and obtain sensitive information. This is also known as the "CCS Injection"...
Denial Of Service (DoS)
coreutils is vulnerable to denial of service. The sort, uniq, and join utilities did not properly restrict the use of the alloca function, which allows an attacker to crash those utilities in a stack-based buffer overflow by providing long input strings...
Unspecified Flaw
Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw in an NVIDIA driver, which has unknown impact and attack vectors...
Man-in-the-Middle (MitM)
python is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the ssl.matchhostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a \0 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...
Denial Of Service (DoS)
kernel-rt is vulnerable to denial of service. Incorrect handling of the Delay and Unwritten buffer head states in the journalunmapbuffer function in fs/jbd2/transaction.c allows local attackers to crash systems that have an ext4 file system with a journal mounted...
Remote Code Execution (RCE)
xterm is vulnerable to remote code execution attacks. The vulnerability exists when xterm mishandles special characters, allowing RCE attacks...
Remote Code Execution (RCE)
Microsoft.ChakraCore is vulnerable to remote code execution. This is due to an out-of-bounds in the ChakraCore JIT which would allow an attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2018-8617, CVE-2018-8618, CVE-2018-8624,...
Cross-site Scripting (XSS)
tomcat-http is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the assumption that the Accept-Language header value received conforms to RFC 2616, allowing XSS attacks...
Session Hijacking
Apache Tomcat is vulnerable to session hijacking. Sensitive information such as the session ID can be leaked to remote attackers due to improper handling of double quotes " characters and encoded backslash %5C in the cookie value. This vulnerability exists due to an incomplete fix for CVE-2007-33...
Information Disclosure
catalina is vulnerable to information disclosure attacks. The vulnerability exists as user enumeration is possible throug the FORM authentication as it does not check if credentials is null...
Authentication Bypass
catalina is vulnerable to authentication bypass attacks. The vulnerability exists due to the improper handling of failed undeploy where the appBase files can remain after the failed undeploy process...
Denial Of Service (DoS) Through Null Pointer Dereference
imagemagick is vulnerable to denial of service DoS attacks. The vulnerability exists in property.c where an assert does not properly catches an error which allows an image object to be null, causing a DoS attackk through null pointer dereference...
Out-Of-Bounds Read
libvirt.so is vulnerable to an out-of-bound read. The vulnerability exists in qemuDomainGetBlockIoTune function in qemu/qemudriver.c file because the live definition is used to look up the disk index while the persistant one is indexed which allows an attacker to cause a denial of service conditi...
Invalid Memory Dereference
libexiv2.so is vulnerable to invalid memory address dereference attacks. The vulnerability exists in Exiv2::StringValueBase::read of value.cpp while parsing an image with malicious exif values, causing a denial of service DoS attack...
Cross-site Scripting (XSS)
drupal/drupal is vulnerable to cross-site scripting XSS attacks. The checkPlain function doesn't properly sanitize escape characters, allowing a malicious user to inject and execute arbitrary Javascript...
Denial Of Service (DoS) Through Stack Buffer Overflow
libarchive.so is vulnerable to denial of service DoS through stack-based buffer overflow attacks. The vulnerability exists in safefprintf of tar/util.c when printing a filename can cause a buffer overflow when formatting a non-printable multi-byte character...
Copy-paste Vulnerability Through LibXML2
Nokogiri and chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to the following CVEs: 1 CVE-2017-16931 - LibXML2 incorrectly handles parameter-entity references in parser.c. 2 CVE-2017-16932 - LibXML2 can enter an infinite...
Denial Of Service (DoS)
FFmpeg is vulnerable to denial of service DoS attacks. A malicious user can pass a file which contains a large itemnum value to bypass the large value checking, causing the file to consume a large amount of memory that can lead to memory exhaustion in the system...
Regular Expression Denial Of Service (ReDoS)
struts2-core and xwork-core are vulnerable to regular expression denial of service ReDoS attacks. When the URLValidator is used it is possible to overload the server process through an attacker controlled URL. These attacks are as a result of an incomplete fix for CVE-2017-7672...