Information Disclosure

netdata is vulnerable to Information Disclosure. Netdata Agents have an automatically generated MACHINE GUID that is saved to disk and can persist across restarts and reboots. Streaming is a feature that allows a Netdata Agent to act as parent for other Netdata Agents children, offloading childre...

Denial Of Service (DoS)

Linux kernel is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the SGI GRU driver because of the way the first grufileunlockedioctl function is called by the user, where a failed pass occurs in the grucheckchipletassignment function, allowing an attacke...

Arbitrary Code Execution

webkitgtk is vulnerable to Arbitrary Code Execution. Processing maliciously crafted web content may lead to arbitrary code execution which allows a remote attacker to create a specially crafted web page and trick the victim into opening it, triggering type confusion, and execute arbitrary code on...

Denial Of Service (DoS)

go is vulnerable to Denial of Service DoS attacks. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses...

Type Confusion

openssl is vulnerable to type confusion. The vulnerability exists because it may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory content...

Denial Of Service (DoS)

kernel is vulnerable to Denial of Service DoS attacks. The vulnerability exists in the smb2ioctlqueryinfo function of fs/cifs/smb2ops.c, in Common Internet File System CIFS due to an incorrect return from the memdupuser function. This flaw allows a local, privileged attacker to crash the system...

IP Spoofing

parse-server is vulnerable to IP Spoofing Attack Via HTTP Request Header. The vulnerability exists due to the incorrect implementation of the client IP address in the parse server option masterKeyIps of the library, which sets the allowed IP address to the the x-forwarded-for header value, allowi...

Denial Of Service (DoS)

kernel is vulnerable to Denial of Service DoS attacks. A race condition may lead to a NULL pointer dereference and general protection fault via VTRESIZEX ioctl, resulting in an application crash...

Denial Of Service (DoS)

Linux Kernel is vulnerable to Denial Of Service DoS. The vulnerability exists in the i740 driver because the Userspace program could pass any values to the driver through the ioctl interface, which doesn't check the value of pixclock, causing a divide by zero error...

Remote Code Execution

xwayland is vulnerable to remote code execution. The handler for the ScreenSaverSetAttributes request may write to memory after it has been freed leading to local privileges elevation on systems where the server is running privileged and remote code execution for ssh X forwarding sessions...

Unrestricted Key Type

jsonwebtoken uses unrestricted key type. A remote attacker is able to bypass signature verification if the library is misconfigured so that legacy, insecure key types are used for the verification. The user is affected if the library uses an algorithm and a key type other than a combination liste...

Regular Expression Denial Of Service (ReDoS)

rails-html-sanitizer is vulnerable to regular expression denial of service. The vulnerability exists due to the insecure regex pattern used for the attrnode.value attribute in the scrubattributes function of scrubbers.rb, allowing an attacker to crash the application by providing malicious SVG...

Arbitrary Code Injection

akeneo/pim-community-dev is vulnerable to arbitrary code injection. The vulnerability exists in Location parameter in httpd.conf because of not properly validate user inputs which allows an attacker to inject and execute malicious code into the system...

Improper Certification Validation

certifi is vulnerable to improper certificate validation. The vulnerability exists due to an untrustworthy certificate authority TrustCor root certificate, which are now marked as invalid...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The vulnerability exists due to excessive memory allocation which allows an attacker to cause an application crash due to overflows...

Denial Of Service (DoS)

Linux kernel’s KVM is vulnerable to denial of service. The vulnerability exists due to a NULL pointer dereference which allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service...

Information Disclosure

rh-mysql80-mysql is vulnerable to denial of service. The vulnerability exists in the Server: Optimizer component, allowing attackers to cause an application crash and modify the critical data or all MySQL Server accessible data through multiple protocols...

Integer Overflow

libtiff.so is vulnerable to integer overflow. The vulnerability is due to memory corruption in tifgetimage.c, which allows the remote attacker to crash the application...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to cross-site scripting. The vulnerability is due to the origin query argument in the getsafeurl function of views.py which allows an attacker to inject and execute arbitrary scripts...

Prototype Pollution

uglify-js is vulnerable to prototype pollution. The vulnerability exists in DEFNODE function of ast.js via the name variable which allows an attacker to inject malicious property resulting in prototype pollution...

HTTP Request Smuggling

Go is vulnerable to HTTP request smuggling. The vulnerability is due to a lack of sanitizations in the query parameter for ReverseProxy. Remote attackers can cause query parameter smuggling when a go proxy forwards a parameter with an unparseable value...

Authorization Bypass

modsecurity-crs:sid is vulnerable to authorization bypass. The vulnerability exists due to repeated payloads with a HTTP range header field, allowing an attacker to do a response body bypass by accessing to restricted resources...

Improper Access Control

chromium is vulnerable to improper access control. The vulnerability is because of an incorrect security ui due to a flaw found in the Full Screen of the Chromium browser which allows an attacker to perform unauthorized actions...

Authentication Bypass

moodle/moodle is vulnerable to authentication bypass. The vulnerability exists in the userlogin function of auth.php due to a type juggling, which allows an attacker to access restricted domains via the external database authentication...

Heap-buffer-overflow

binutils, edge is vulnerable to a heap buffer overflow. The vulnerability exists in bfdgetl32 function when called from the stripmain function in strip-new via a malicious file...

Information Disclosure

thunderbird is vulnerable to information disclosure. An attacker can gain sensitive information when composing a response to an HTML email with a META refresh tag...

Denial Of Service (DoS)

sdk-server is vulnerable to denial of service. The vulnerability exists because the maximum number of monitored items per session does not properly configure in the getMaxMonitoredItems function of OpcUaServerConfigLimits.java, allowing an attacker to cause an application crash by sending multipl...

Denial Of Service (DoS)

github.com/helm/helm is vulnerable to denial of service DoS attacks. A remote authenticated attacker is able to cause an out of memory panic by supplying malicious string inputs to functions in the strvals package, resulting in denial of service conditions...

Denial Of Service (DoS)

libtiff.so is vulnerable to denial of service. The vulnerability exists due a heap buffer overflow in TIFFReadRawDataStriped function in tiffinfo.c which allows an attacker to cause an application crash via a crafted TIFF file...

Denial Of Service (DoS)

vim is vulnerable to remote code execution. The vulnerability exists due to a use after free allowing an attacker to crash the system via memory corruption...

Privilege Escalation

ansible is vulnerable to privilege escalation. A remote authenticated attacker with change user permissions is able to modify the account settings of the superuser account and/or remove the superuser privileges...

Out-of-bounds Write

vim is vulnerable to out-of-bounds write. The vulnerability exists due to invalid memory access after diff buffer manipulations in 1diffmarkadjusttp function in diff.c...

SQL Injection

loopback-connector-postgresql is vulnerable to sql injection attacks. The vulnerability exists in buildExpression function in postgresql.js because the user provided inputs for contains loopback filter are not properly sanitized which allows an attacker to inject and execute arbitrary sql command...

Denial Of Service (DoS)

vim is vulnerable to denial of service. The vulnerability exists due to an Out-of-bounds Read allowing an attacker to crash the system with a maliciously crafted string constant...

Out-Of-Bounds Write

net-snmp is vulnerable to out of bounds write. The vulnerability exists due to a boundary error in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable. A remote user is able to pass a malformed OID in a SET request, trigger an out-of-bounds write and execute arbitrary code on the target...

Heap-Buffer Overflow

lua5.4 is vulnerable to heap-buffer overflow. The vulnerability exists in the component luaGrunerror when a recursive error occurs which allows an attacker to cause an application crash...

Denial Of Service (DoS)

vim is vulnerable to denial of service. An attacker can crash the application through the use after free...

Command Injection

python is vulnerable to command injection. The vulnerability exist due to mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input...

DLL Hijacking

node is vulnerable to dll hijacking. The vulnerability exists due to the default open ssl configuration which allows an attacker to exploit the vulnerability by placing a malicious dll file on an affected system...

Privilege Escalation

github.com/argoproj/argo-cd is vulnerable to privilege escalation. Lack of enforcement of access restriction by application resource API allows an attacker to escalate the privileges to admin-level...

Denial Of Service (DoS)

ujson is vulnerable to denial of service. The vulnerability exists in decodestring function in ultrajsondec.c when reallocation of buffer fails during string decoding which frees the buffer twice causing an application crash...

Information Disclosure

guzzlehttp/guzzle is vulnerable to information disclosure. The vulnerability exists because the checkRedirect function of RedirectMiddleware.php does not properly clear the CURLOPTHTTPAUTH option on a change of origin, allowing an attacker to get sensitive information through the Authorization...

Use After Free

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev commit b5f1eacd and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability...

Privilege Escalation

xen is vulnerable to privilege escalation. The vulnerability exists due to non-coherent mappings allowing an attacker to control the whole system because the system safety logic doesn't account for CPU-induced cache...

Denial Of Service (DoS)

.NET and Visual Studio is vulnerable to Denial of Service. The vulnerability exists due to a flaw was found in dotnet allowing an attacker to crash the system by parsing HTML forms...

Denial Of Service (DoS)

servicemesh-proxy is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization which allows an attacker to crash the system via a NULL pointer dereference when using a WT filter saferegex match via a crafted request...

Command Injection

github.com/hashicorp/go-getter is vulnerable to command injection. The vulnerability exists in clone function in gethg.go due to improper handling of user input which allows an attacker to inject and execute arbitrary commands...

Denial Of Service (DoS)

protobuf is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization in google.protobuf.UnknownFieldSet parameter which allows a remote attacker to inject a malicious javascript into the system and crash. which allowing an attacker to...

Use-After-Free

vim is vulnerable to use-after-free. The vulnerability exists in appendcommand which allows an attacker to cause a memory corruption which then leads to an application crash...

Prototype Pollution

protobufjs is vulnerable to Prototype Pollution. An attacker is able to add/modify properties of the Object.prototype by parsing/loading .proto files or via providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions, resulting in prototype pollution...