Denial Of Service (DoS)

ImageMagick is susceptible to denial of service DoS attacks. The vulnerability is caused due to not properly handling memory allocation in the formatIPTC method in coders/meta.c...

Unauthorized Access

WordPress is vulnerable to unauthorized access. The attack is possible because the library uses the SERVERNAME variable to get the hostname of the server for PHP mail functions, allowing an attacker to modify the hostname of his choice and trigger a password reset function. However, the attack ca...

Signature Verification Bypass

namashi/jose is vulnerable to signature verification bypass. The library didn't check for the "none" algorithm without case, allowing attackers to easily bypass the signature verification mechanism...

Directory Traversal

github.com/docker/docker is vulnerable to path traversal attacks and spoofed repositories. These attacks are possible because Docker fails to correctly validate image IDs when using docker load or register communications...

Denial Of Service (DoS)

expat is vulnerable to denial of service DoS attacks, with the possibility of other attacks. The vulnerability exists because there are multiple integer overflows in the XMLGetBuffer function that leads to a heap-based buffer overflow which may lead to further unspecified impact. CVE-2016-4472 is...

Cross-site Scripting (XSS)

Glassfish admingui is vulnerable to cross-site scripting XSS attacks. The library does not escape user input in the configNameSection, making it vulnerable to XSS attacks...

Prototype Override Protection Bypass

qs is vulnerable to prototype override protection bypass. It is possible for an attacker to bypass the protection and overwrite prototype properties and functions by prefixing the name of the parameter with or . Overwriting these properties on the object prototype can impact application logic,...

Denial Of Service (DoS) Through Memory Consumption

OpenSSL is vulnerable to denial of service DoS attacks. These attacks are possible due to a memory leak in the dtls1bufferrecord function which can be triggered by sending duplicate records for the next epoch...

Server-Side Request Forgery (SSRF)

ImageMagick is vulnerable to server-side request forgery SSRF. A malicious user can send a malicious .mvg file to force a HTTP, GET or FTP request a user...

Security Constraint Bypass

Spring security web is vulnerable to security constraint bypass. It does not consider URL path parameters when processing security constraints. By adding an URL path parameter with an encoded / to a request, an attacker is able to bypass a security constraint. The root cause of this issue is a la...

Remote Code Execution (RCE)

9router is vulnerable to Remote Code Execution RCE. The vulnerability is due to missing authentication checks on /api/cli-tools/ and /api/mcp/ endpoints, which allows an attacker to chain unauthenticated API calls and execute arbitrary OS commands remotely...

Account Takeover

Sentry is vulnerable to Account Takeover. The vulnerability is due to improper handling of SAML Identity Providers, which allows an attacker to craft a malicious SAML response and associate it with a different organization on the same Sentry instance...

Path Traversal

langchain is vulnerable to path traversal. The vulnerability is due to improper input sanitization in the getFullPath method, which allows attackers to exploit the setFileContent, getParsedFile, and mdelete methods, enabling them to save files anywhere in the filesystem, overwrite existing text...

Denial Of Service (DoS)

.NET is vulnerable to Denial of Service DoS. The vulnerability is due to excessive CPU consumption caused by parsing a malicious X.509 certificate or collection of certificates. An attacker can exploit this by providing a specially crafted certificate that triggers high CPU usage, resulting in...

Cross-Site Scripting (XSS)

froxlor/froxlor is vulnerable to Cross-Site Scripting. The vulnerability is due to inadequate sanitization of user input in the loginname parameter during failed login attempts, which allows attackers to inject and store malicious scripts that are executed when an administrator views the System...

Improper Certificate Validation

Salt is vulnerable to improper SSL certificate validation. The vulnerability is due to the absence of proper default verification for SSL certificates when authenticating to services using certain modules. This flaw allows attackers to perform man-in-the-middle attacks...

Biased ECDSA Nonce Generation

PuTTYis vulnerable to biased ECDSA nonce generation. The vulnerability is due to biased ECDSA nonce generation, allowing an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is particularly significant in scenarios where an adversary can re...

Arbitrary Code Execution

Firefox, Firefox ESR, Thunderbird are vulnerable to an Arbitrary Code Execution vulnerability. The vulnerability is due to leveraging the Windows Error Reporter to run arbitrary code, escaping the sandbox...

Improper Input Validation

Apache is vulnerable to Improper Input Validation. The vulnerability is caused due to inadequate input validation, which can be exploited by attackers to manipulate HTTP responses...

Sensitive Information Disclosure

libmbedtls.so is vulnerable to Sensitive Information Disclosure. The vulnerability is due to inadequate handling of shared memory within the PSA Crypto API, potentially leading to information disclosure...

Denial Of Service

jetty-http is vulnerable to Denial Of Service DoS. The vulnerability is due to GOAWAY frames failing to be written to the queue when there is TCP congestion within the server. An attacker can exploit idle timeout periods to leave HTTP/2 or 3 connections in the ESTABLISHED state, even when they...

Assertion Failure

bind9 is vulnerable to Assertion Failure. The vulnerability is due to assertion failure when the resolver receives a PTR Pointer Record query for an RFC 1918 address a private IP address as defined by the Internet Assigned Numbers Authority in nxdomain-redirect ; configuration. which leads to a...

Use After Free

chromium is vulnerable to Use After Free. The vulnerability is due to improper handling of memory within the Network component, This potentially allowing a remote attacker to exploit heap corruption through a malicious file and can leads to Denial of service...

Denial Of Service (DOS)

mariadb is vulnerable to Denial Of Service DOS. The vulnerability is due to how the InnoDB component handles certain conditions, allowing a high privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash of the MySQL Server...

Sensitive Information Disclosure

org.apache.tomcat: tomcat-coyote is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of IOExceptions in the fill function within Http11InputBuffer.java during socket read operations, particularly when the client abruptly closed the connection. This cou...

Heap Buffer Overflow

libxml2 is vulnerable to Heap Buffer Overflow. The vulnerability is due to improper bound checking. This issue can be exploited by an attacker via parsing a malicious file to execute arbitrary code within the context of an unprivileged process...

SQL Injection And Path Traversal

Cacti is vulnerable to SQL Injection and Path Traversal. The vulnerability is caused due to improper input sanitization within link.php component. This allows an authorized user to execute arbitrary code on the server...

Buffer Overflow

SQLite is vulnerable to heap-based buffer overflow. The vulnerability is due to the sessionReadRecord function within ext/session/sqlite3session.c, which allows an attacker to manipulate the pIn parameter which results in a buffer overflow...

SMTP Smuggling

Postfix is vulnerable to SMTP smuggling. The vulnerability is caused due to support for . while handling line endings. A remote attacker can exploit this using published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection...

Arbitrary Code Execution

github.com/free5gc/amf/ is vulnerable to Arbitrary Code Execution. The vulnerability arises due to a lack of validation for invalid NGAP messages. An attacker can execute remote code and cause DoS via a crafted NGAP message...

Improper Certificate Validation

Snowflake.data is vulnerable to Improper Certificate Validation. The vulnerability is due to not checking the Certificate Revocation List CRL when insecureMode is set to its default value of false. This allows an attacker with access to the private key of a correctly issued certificate to execute...

Heap Buffer Overflow

chromium:sid is vulnerable to Heap buffer overflow. The vulnerability due to Type confusion can accessing a resource with an incompatible type, leading to logical errors and type-related issues.. It allow a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Denial Of Service (DoS)

libsquid.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to a buffer overread bug in the library. This allows an attacker to cause an application crash during HTTP message processing...

Denial Of Service (DoS)

Spring Boot is vulnerable to Denial Of Service. The vulnerability is due to parsing malicious HTTP Request without proper validation or sanitization. This issue can be exploited by an attacker via crafting mailicous HTTP Request leading to Denial Of Service. Note that the following conditions mus...

Request Smuggling

aiohttp is vulnerable to Request Smuggling. The vulnerability exists due to improper HTTP method validation in the init function of clientreqrep.py. This allows an attacker to modify the HTTP request, such as inserting a new header or even creating a new HTTP request if the attacker can control t...

Authentication Bypass

authentik is vulnerable to authentication bypass due to an insufficient PKCE check. The vulnerability is caused by codeverifier step during the OAUTH initialisation flow. Authentik improperly accepts the token request when codeverifier is omitted, even when the flow was started with a...

Information Disclosure

wordpress is vulnerable to Information Disclosure. An attacker could exploit this vulnerability by tricking a user into installing a malicious Popup Builder plugin or by uploading a malicious plugin to a vulnerable WordPress installation. The malicious plugin would then inject malicious code into...

Denial Of Service (DoS)

openssl gitlab is vulnerable to Denial of Service DoS. An attacker could exploit this vulnerability by tricking a user into processing a specially crafted DH key or parameter. The vulnerable application would then attempt to generate or check the DH key or parameter, which would consume excessive...

Use After Free

chromium is vulnerable to Use After Free. The vulnerability exists in the WebAudio component in the library, which allows an attacker to potentially exploit heap corruption via a crafted HTML page...

Buffer Overflows

qemu is vulnerable to Buffer Overflows. A guest I/O address overflow vulnerability allows an attacker to overwrite arbitrary memory on the host system by exploiting a flaw in the way that QEMU handles guest I/O operations...

Cross-site Scripting (XSS)

chromium is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the inappropriate implementation in Payments, which allows an attacker to bypass XSS preventions via a malicious file...

Remote Code Execution (RCE)

chromium is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the incorrect security UI in Downloads, which allows a remote malicious attacker to obfuscate security UI via a crafted HTML page...

Buffer Overflows

memcached is vulnerable to Buffer Overflows. An attacker could exploit this vulnerability by sending a specially crafted multiget request to a vulnerable Memcached server when there are many spaces after the "get" substring for multiget requests in proxy mode. The server would then attempt to...

Improper Authorization

samba is vulnerable to Improper Authorization. This vulnerability allows an attacker to truncate files, even with read-only permissions, when the Samba VFS module aclxattr is configured with aclxattr:ignore system acls = yes...

Denial Of Service (DoS)

Golang.org/x/net is vulnerable to Denial of Service DoS. This vulnerability exists due to a flaw which allows a user to send a request, and quickly cancel it. The http2.Server.MaxConcurrentStreams limits the amount of allowed inflight requests, but does not handle the situation of resetting the...

Denial Of Service (DoS)

libtiff.so is vulnerable to Denial of Service DoS. The vulnerability is due to the OJPEGReadHeaderInfoSecTablesQTable function in tifojpeg.c, which allows an attacker to cause a denial of service DoS attack by tricking a victim into opening a specially crafted TIFF image file...

Denial Of Service (DoS)

qemu is vulnerable to Denial of Service DoS. A Division by Zero vulnerability allows local attackers to crash QEMU and the guest operating system by sending a specially crafted SCSI command...

Cross-Site Scripting (XSS)

html/template is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability exists because the package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in...

Improper Input Validation

apache-superset is vulnerable to Improper Input Validation. The vulnerability allows an attacker to trick a user into potentially registering a SQLite database connection incorrectly if an attacker employs alternative driver names such as sqlite+pysqlite or utilizes database imports. This...

Cross-site Scripting (XSS)

github.com/prometheus/alertmanager is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of HTML sanitization in the generatorURL field of Alert.elm, which allows an attacker to inject and execute malicious JavaScript by sending a POST request to the /api/v1/alerts...