38790 matches found
Arbitrary Code Execution Through REST API Call
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...
Request-smuggling Attacks
Apache Tomcat Coyote before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, doesn't handle inconsistent HTTP request headers well when an HTTP or AJP connector is used. This allows remote attackers to incorrectly identify the requests length and conduct request-smuggling attacks through...
Denial Of Service (DoS)
kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the nfs4getacluncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cau...
Denial Of Service (DoS)
libxml2 is vulnerable to denial of service DoS attacks. The vulnerability exists as an off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact v...
Cross-site Request Forgery (CSRF)
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...
Denial Of Service (DoS)
krb5 is vulnerable to denial of service DoS attacks. The vulnerability exists as schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 aka krb5 before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service CPU and...
Arbitrary File Overwrite
hplip3 is vulnerable to arbitrary file overwrite attacks. The vulnerability exists as the senddatatostdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing HPLIP 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out...
Timing Side- Channel Attack
OpenSSL is vulnerable to timing attacks. It happens because of lack of validation of MAC addresses in constant time during the processing of a malformed CBC padding. It is also known as "Lucky Thirteen" issue...
Man-in-the-Middle (MitM)
OpenSSL is vulnerable to man in the middle MitM attacks. These attacks are possible because an attacker can force OpenSSL to use a zero-length master key. This allows attackers to hijack sessions and obtain sensitive information. This is also known as the "CCS Injection"...
Denial Of Service (DoS)
coreutils is vulnerable to denial of service. The sort, uniq, and join utilities did not properly restrict the use of the alloca function, which allows an attacker to crash those utilities in a stack-based buffer overflow by providing long input strings...
Denial Of Service (DoS)
kernel-rt is vulnerable to denial of service. Incorrect handling of the Delay and Unwritten buffer head states in the journalunmapbuffer function in fs/jbd2/transaction.c allows local attackers to crash systems that have an ext4 file system with a journal mounted...
Remote Code Execution (RCE)
Microsoft.ChakraCore is vulnerable to remote code execution. This is due to an out-of-bounds in Edge WIP which would allow an attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2018-8583, CVE-2018-8617, CVE-2018-8618, CVE-2018-8624...
Heap-Based Buffer Overflow
libraw.so is vulnerable to denial of service. The LibRaw::panasonicloadraw function in dcrawcommon.cpp does not properly handle TIFF files, allowing an attacker to submit a malicious TIFF to cause a heap-based buffer overflow and crash the application...
Arbitrary Code Execution
Libraw.so is vulnerable to code execution. An error within the findgreen function in internal/dcrawcommon.cpp allows an attacker to execute code via a stack-based buffer overflow...
Remote Code Execution (RCE)
Microsoft ChakraCore is vulnerable to remote code execution. This is due to how the scripting engine handles objects in memory, allowing a remote attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2017-0224, CVE-2017-0228, CVE-2017-0230,...
Replay Attack
tomcat-util is vulnerable to replay attacks. The vulnerability exists due to the improper handling of empty requests to the SSL port, allowing a duplicate copy of a recent request to be replayed...
Denial Of Service (DoS)
libnetsnmp.so is vulnerable to denial of service DoS attacks. A malicious user can pass a GetNext PDU with multiple Varbinds to the application, causing a NULL Pointer Exception that can crash the application...
Man-in-the-Middle (MitM)
node.js is vulnerable to a man-in-the-middle MitM attack. The library does not properly handle the wildcard character in the X.509 Certificate namefields. This can allow a malicious user to spoof servers and cause a MitM attack...
Sensitive Information Leakage
IdentityServer3 is vulnerable to sensitive information leakage. The leakage of identityserver responses is possible because there is a flaw in Angular expression on the authorize response page...
Denial Of Service (DoS)
libtiff.so is vulnerable to denial of service DoS attacks. A malicious user can pass a tiff file encoded with LogL compression to the application, causing an out-of-bound read that can cause the application to crash...
Denial Of Service (DoS)
libtiff.so is vulnerable to denial of service DoS attack. A malicious user can pass a tiff file to the NeXTDecode function in tifnext.c to cause an out-of-bounds write that can crash the application...
Arbitrary File Write
wildfly-deployment-repository is vulnerable to the zip-slip vulnerability. The library does not validate the target path when extracting and deploying .war files, leading to arbitrary file writes outside of the intended target directory...
Remote Code Execution (RCE)
microsoft.chakracore is vulnerable to remote code execution RCE attacks. The library does not call the ImplicitCallFlags during code interpretation, leading to arbitrary code being injected and executed...
Cross-site Scripting (XSS)
phpmyadmin is vulnerable to cross-site scripting XSS attacks. A malicious user can use the database variable to inject and execute arbitrary Javascript when the database variable is called through the designer feature...
Denial Of Service (DoS)
libvirt.so is vulnerable to denial of service DoS attack. The attack is possible because it does not limit the size of buffer while reading data from Qemu monitor...
Out-of-Bounds Read
libapr-1.so is vulnerable to out-of-bounds read. A malicious user can pass a invalid month value to the aprtimeexp or the aprosexptime functions to cause an out-of-bounds read that can lead to sensitive information being disclosed or the application crashing...
Denial Of Service (DoS) Through Stack Buffer Overflow
libarchive.so is vulnerable to denial of service DoS through stack-based buffer overflow attacks. The vulnerability exists in safefprintf of tar/util.c when printing a filename can cause a buffer overflow when formatting a non-printable multi-byte character...
Denial Of Service (DoS) Through NULL Pointer Dereference
libtiff.so is vulnerable to denial of service DoS through null pointer dereference. A malicious user can pass a image file to the TIFFPrintDirectory function in tifprint.c, causing a null pointer dereference that can crash the application...
Remote Code Execution (RCE)
spring-messaging is susceptible to remote code execution RCE attack. The vulnerability exists through the simple STOMP broker that exposes a weakness to malicious users who can perform a RCE attack through the STORM payload...
Regular Expression Denial Of Service (ReDoS)
Django is vulnerable to regular expression denial of service attacks.The application takes more than linear time when certain strings are passed to the urlize function, resulting in an application crash...
XML External Entity (XXE) Injection
itextpdf is vulnerable to XML external entity XXE injection attacks. These attacks are possible because the library does not disable external entities when parsing pdf files...
Copy-paste Vulnerability Through LibXML2
Nokogiri and chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to the following CVEs: 1 CVE-2017-16931 - LibXML2 incorrectly handles parameter-entity references in parser.c. 2 CVE-2017-16932 - LibXML2 can enter an infinite...
Arbitrary Code Execution
spring-data-rest servers are vulnerable to arbitrary code execution attacks. The attacks exist because it does not check the path before processing PATCH requests to the server, allowing the attackers to submit patch requests with malicious JSON data...
Denial Of Service (DoS)
FFmpeg is vulnerable to denial of service DoS attacks. A malicious user can pass a file which contains a large itemnum value to bypass the large value checking, causing the file to consume a large amount of memory that can lead to memory exhaustion in the system...
Write Files Outside Of Repository
Mercurial is vulnerable to files outside of the repository being overwritten. This is because the symlink auditing isn't complete which allows attackers to write files outside of the repository...
Cross-site Scripting (XSS)
plupload is vulnerable to cross-site scripting XSS attacks. The moxie.swf file contains a function that takes in user input and returns a result via a callback endpoint. This can allow a malicious user to inject and execute arbitrary script through a Same Origin Method Execution SOME attack...
Directory Traversal
github.com/docker/docker is vulnerable to path traversal attacks and spoofed repositories. These attacks are possible because Docker fails to correctly validate image IDs when using docker load or register communications...
Cross-site Scripting (XSS)
Glassfish admingui is vulnerable to cross-site scripting XSS attacks. The library does not escape user input in the configNameSection, making it vulnerable to XSS attacks...
Denial Of Service (DoS)
ImageMagick is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious MIFF file to the system to trigger an infinite loop to occur that can cause the system to run out of resources and crash...
Denial Of Service (DoS)
FFmpeg is vulnerable to denial of service DoS attacks or possibly other attacks. A malicious user can pass a malicious png file to the system that can cause an out-of-bounds array access that can lead to the system crashing...
Denial Of Service (DoS) Through Memory Consumption And Application Crash
OpenSSL is vulnerable to denial of service DoS attacks through memory consumption and application crash. This is caused because the dtls1clearqueues function in d1lib.c frees data not taking into account that application data could arrive between the ChangeCipherSpec message and the Finished...
Information Disclosure
OpenSSL is vulnerable to padding oracle attacks. A malicious user can use an SSLv2 server as a Bleichenbacher oracle, allowing the malicious user to decrypt TLS ciphertext data...
Carry Propagation
bouncycastle is vulnerable to carry propagation bugs. This bug caused mathematical miscalculations during static Elliptic Curve Diffie Hellman which in rare cases for it to miscalculate elliptic curve scalar multiplication. This allows a malicious user in certain cases to obtain the key...
Security Constraint Bypass
Spring security web is vulnerable to security constraint bypass. It does not consider URL path parameters when processing security constraints. By adding an URL path parameter with an encoded / to a request, an attacker is able to bypass a security constraint. The root cause of this issue is a la...
XML External Entity (XXE)
Apache CXF JAX-RS is vulnerable to XML eternal entity XXE attacks. The Atom MessageBodyReaders use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk...
Server-Side Request Forgery
github.com/quantumnous/new-api, is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to incomplete SSRF protection that fails to block the unspecified address 0.0.0.0, allowing authenticated users to bypass private-IP filtering and force the server to make requests to...
Type Confusion
Handlebars is vulnerable to Type Confusion. The vulnerability is due to unsanitized handling of pre-parsed AST input in Handlebars.compile, which allows an attacker to inject malicious JavaScript via crafted AST nodes and execute arbitrary code...
SQL Injection
flowise-components is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the tableName parameter in PostgresVectorStore, which allows an attacker to execute arbitrary SQL commands...
Account Takeover
Sentry is vulnerable to Account Takeover. The vulnerability is due to improper handling of SAML Identity Providers, which allows an attacker to craft a malicious SAML response and associate it with a different organization on the same Sentry instance...
Path Traversal
WebMvc.fn and WebFlux.fn are vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user input in handling file paths, allows attackers to craft requests that bypass security restrictions and access unauthorized files on the server...