Lucene search
+L
VeracodeMost viewed

38790 matches found

Veracode
Veracode
•added 2024/07/30 8:52 a.m.•39 views

Stack-based Buffer Overflow

libcurl.so is vulnerable to a Stack-based Buffer Overflow. The vulnerability is due to improper handling of memory in the utf8asn1str function, which invokes free function on a 4-byte local stack buffer when detecting an invalid field. Attackers can exploit this flaw to overwrite nearby stack...

7.5CVSS6.5AI score0.04296EPSS
SaveExploits1References7Affected Software2
Veracode
Veracode
•added 2024/06/06 8:19 a.m.•39 views

Integer Underflow

Envoy is vulnerable to Integer Underflow. The vulnerability is due to an integer underflow in the QuicStreamSequencerBuffer::PeekRegion implementation, causing a crash at QuicheDataReader::PeekVarInt62Length...

7.5CVSS6.7AI score0.00693EPSS
SaveExploits1References2Affected Software1
Veracode
Veracode
•added 2024/05/10 8:33 a.m.•39 views

SQL Injection

Npgsql is vulnerable to SQL injection. The vulnerability is caused by an integer overflow in the WriteBind method within NpgsqlConnector.FrontendMessages.cs, which leads to miscalculated message lengths when constructing PostgreSQL protocol messages. This allows attackers to manipulate message...

8.1CVSS8.3AI score0.01716EPSS
SaveExploits0
Veracode
Veracode
•added 2024/04/26 6:59 a.m.•39 views

Arbitrary Command Execution

less is vulnerable to Arbitrary Command Execution.The vulnerability is due to the omission of shellquote calls for LESSCLOSE in the closealtfile function within the filename.c file of the less command-line utility, allows attackers to execute arbitrary commands...

7.8CVSS7AI score0.01059EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2024/04/19 1:24 a.m.•39 views

Out-of-Bounds-Read

firefox is vulnerable to Out-of-Bounds-Read. The vulnerability is due to incorrect optimization of switch statements by the JIT Just-In-Time compiler. It results in code with out-of-bounds-reads in certain code patterns involving switch statements...

8.8CVSS6.3AI score0.00733EPSS
SaveExploits0References7Affected Software3
Veracode
Veracode
•added 2024/04/15 4:55 a.m.•39 views

Remote Code Execution (RCE)

org.xwiki.commons:xwiki-commons-velocity is vulnerable Remote Code Execution RCE. The vulnerability is due to improper HTML escape functionality, where the escaping tool used in XWiki fails to properly escape the character. This allows an attacker to inject malicious XWiki syntax, potentially...

10CVSS7.2AI score0.02104EPSS
SaveExploits1References7Affected Software1
Veracode
Veracode
•added 2024/04/12 11:39 a.m.•39 views

Code Injection

Apache Zeppelin is vulnerable to a Code Injection. The vulnerability is due to improper verification of the JDBC driver configuration which allows an attacker to inject malicious code when connecting MySQL database...

9.8CVSS7.2AI score0.07793EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2024/04/03 12:15 p.m.•39 views

Sensitive Information Disclosure

libmbedtls.so is vulnerable to Sensitive Information Disclosure. The vulnerability is due to inadequate handling of shared memory within the PSA Crypto API, potentially leading to information disclosure...

8.2CVSS6.8AI score0.00847EPSS
SaveExploits0References5Affected Software2
Veracode
Veracode
•added 2024/03/17 7:28 p.m.•39 views

Improper Authentication

wpasupplicant is vulnerable to the Improper Authentication vulnerability. The vulnerability arises because wpasupplicant can be configured to skip TLS certificate verification during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be exploited to bypass Phase 2 authentication...

6.5CVSS6.7AI score0.01177EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2024/03/15 6:11 a.m.•39 views

Denial Of Service (DoS)

org.apache.tomcat: tomcat-websocket is vulnerable to Denial of Service DoS. The vulnerability is due to improper cleanup of WebSocket connections during a session timeout. If a client fails to send a close message within the timeout period, the websocket connection will continue to hold resources...

6.3CVSS6.5AI score0.02313EPSS
SaveExploits0References11Affected Software3
Veracode
Veracode
•added 2024/02/29 4:13 a.m.•39 views

Denial Of Service (DOS)

NodeJS is vulnerable to Denial Of Service DOS. The vulnerability is caused due the fact that the fetch function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed int...

6.5CVSS6.9AI score0.01309EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2024/02/21 8:24 p.m.•39 views

Denial Of Service

nodejs:sid is vulnerable to Denial Of Service. The vulnerability is due to the HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, this server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...

7.5CVSS6.5AI score0.03168EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2024/02/21 3:05 a.m.•39 views

Privilege Escalation

nodejs is vulnerable to Privilege Escalation. The vulnerability is due to a bug in the implementation of the exception of CAPNETBINDSERVICE, Node.js incorrectly applies this exception even when other capabilities have been set. It potentially allows unprivileged users to execute code with elevate...

7.8CVSS7AI score0.00562EPSS
SaveExploits0References4Affected Software3
Veracode
Veracode
•added 2024/02/17 11:24 a.m.•39 views

Denial Of Service

Bind9 is vulnerable to denial of service. The vulnerability is due to asynchronous processes of named running as a recursive resolver component of BIND, when attempting to clean up its cache database which enables the list of queued cleanup events to grow infinitely large over time, allowing the...

7.5CVSS6.5AI score0.01106EPSS
SaveExploits0References6Affected Software2
Veracode
Veracode
•added 2024/02/06 2:50 p.m.•39 views

Bleichenbacher Timing Attack

M2Crypto is vulnerable to Bleichenbacher Timing Attack. The vulnerability is due insecure padding schemes, resulting in the exposure of confidential or sensitive data...

7.5CVSS6.9AI score0.01124EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2024/02/06 12:32 p.m.•39 views

Use After Free

libxml2 is vulnerable to Use After Free. The vulnerability is caused due to a lack of validation within the xmlTextReader module. When parsing a crafted XML document using the XML Reader interface with DTD validation and XInclude expansion enabled, a xmlValidatePopElement use-after-free exception...

7.5CVSS7.1AI score0.01364EPSS
SaveExploits3References4Affected Software4
Veracode
Veracode
•added 2024/02/03 3:53 a.m.•39 views

Information Leak

Google Chrome is vulnerable to Information Leak. The vulnerability is caused due to Inappropriate implementation in Extensions API that causes an attacker to convince a user to install a malicious extension. This can be exploited to leak cross-origin data via a crafted Chrome Extension...

4.3CVSS6AI score0.00579EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2024/01/30 8:19 p.m.•39 views

Denial Of Service (DOS)

mariadb is vulnerable to Denial Of Service DOS. The vulnerability is due to how the InnoDB component handles certain conditions, allowing a high privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash of the MySQL Server...

4.9CVSS6.2AI score0.01782EPSS
SaveExploits0References11Affected Software1
Veracode
Veracode
•added 2024/01/29 6:23 a.m.•39 views

Denial Of Service (DoS)

libtiff.so is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to a lack of validation for row parameter in the TIFFReadRGBATileExt function within tifgetimage.c. This flaw allows a remote attacker to pass a crafted TIFF file to which results in improper handling of data, causin...

7.5CVSS6.7AI score0.02187EPSS
SaveExploits0References23Affected Software1
Veracode
Veracode
•added 2024/01/24 5:56 a.m.•39 views

Minerva Attack

ecdsa is vulnerable to Minerva Attack. The vulnerability is due to timing discrepancies within the ecdsa.SigningKey.signdigest function, which allows attackers to deduce the private key by analyzing the time taken to generate ECDSA signatures with varying nonce sizes. The maintainers will not...

7.4CVSS7AI score0.00985EPSS
SaveExploits1References4Affected Software1
Veracode
Veracode
•added 2024/01/17 7:00 a.m.•39 views

Sensitive Information Exposure

org.apache.solr: solr-core is vulnerable to Sensitive Information Exposure. The vulnerability is caused due to publishing all unprotected environment variables available to each Apache Solr instance thorough Solr Metrics API. An attacker can access Sensitive Information by exploiting this...

6.5CVSS7AI score0.68446EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/12/26 12:49 p.m.•39 views

Insufficient Verification Of Data Authenticity

exim4 library is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to insufficient verification Exim's SMTP server configurations as it support a character sequence . in SMTP transactions, which is not universally supported by other popular email servers. This...

5.3CVSS7.1AI score0.01102EPSS
SaveExploits1References21Affected Software2
Veracode
Veracode
•added 2023/12/26 12:49 p.m.•39 views

SMTP Smuggling

Postfix is vulnerable to SMTP smuggling. The vulnerability is caused due to support for . while handling line endings. A remote attacker can exploit this using published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection...

5.3CVSS6.7AI score0.02635EPSS
SaveExploits4References18Affected Software1
Veracode
Veracode
•added 2023/12/25 2:03 p.m.•39 views

Directory Traversal

Asterisk is vulnerable to Directory Traversal. The vulnerability arises because it allows the reading of any arbitrary file, even when the livedangerously setting is not enabled.This allows arbitrary files to be read...

7.5CVSS6.8AI score0.4557EPSS
SaveExploits3References5Affected Software1
Veracode
Veracode
•added 2023/12/21 9:16 a.m.•39 views

Command Injection

libssh.so is vulnerable to Command Injection. The vulnerability is due to insufficient validation of the hostname parameter in the URI parsing process. This allows attackers to use ProxyCommand or the ProxyJump features to exploit and inject malicious code via the unchecked hostname parameter on...

4.8CVSS7AI score0.00449EPSS
SaveExploits0References9Affected Software2
Veracode
Veracode
•added 2023/12/15 5:01 a.m.•39 views

Heap Buffer Overflow

chromium:sid is vulnerable to Heap buffer overflow. The vulnerability due to Type confusion can accessing a resource with an incompatible type, leading to logical errors and type-related issues.. It allow a remote attacker to potentially exploit heap corruption via a crafted HTML page...

8.8CVSS6.9AI score0.43795EPSS
SaveExploits1References5Affected Software3
Veracode
Veracode
•added 2023/12/15 5:01 a.m.•39 views

Buffer Overflow

chromium:sid is vulnerable to buffer overflow. The vulnerability due to to access a memory location after the memory has been freed or deallocated. It allow a remote attacker to potentially exploit heap corruption via a crafted HTML page...

8.8CVSS6.9AI score0.00645EPSS
SaveExploits0References5Affected Software2
Veracode
Veracode
•added 2023/11/29 9:58 a.m.•39 views

Denial Of Service

Reactor Netty HTTP Server is vulnerable to Denial Of Service DOS. The vulnerability is due to the improper validation of HTTP requests while if the micrometer integration is enabled, which can result in Denial Of Service...

7.5CVSS6.9AI score0.00914EPSS
SaveExploits0References3Affected Software2
Veracode
Veracode
•added 2023/11/29 7:59 a.m.•39 views

Denial Of Service (DoS)

Spring Boot is vulnerable to Denial Of Service. The vulnerability is due to parsing malicious HTTP Request without proper validation or sanitization. This issue can be exploited by an attacker via crafting mailicous HTTP Request leading to Denial Of Service. Note that the following conditions mus...

6.5CVSS7AI score0.01219EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/11/02 6:39 p.m.•39 views

Domain Spoofing

chromium is vulnerable to Domain Spoofing. The vulnerability occurs due to incorrect security UI in Picture In Picture within google chrome which allows a remote malicious attacker to perform domain spoofing via a crafted local HTML page...

4.3CVSS6.7AI score0.00625EPSS
SaveExploits0References10Affected Software1
Veracode
Veracode
•added 2023/10/29 10:30 a.m.•39 views

Buffer Overflows

memcached is vulnerable to Buffer Overflows. An attacker could exploit this vulnerability by sending a specially crafted multiget request to a vulnerable Memcached server when there are many spaces after the "get" substring for multiget requests in proxy mode. The server would then attempt to...

7.5CVSS7.9AI score0.00778EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/10/12 2:31 p.m.•39 views

Information Disclosure

tomcat-catalina is vulnerable to information disclosure. This vulnerability exists due to an improper request recycling mechanism, allowing an attacker to possibly access other requests...

5.3CVSS6.5AI score0.0216EPSS
SaveExploits1References10Affected Software2
Veracode
Veracode
•added 2023/10/11 3:55 a.m.•39 views

Buffer Overflow

libfile.so is vulnerable to Buffer Overflow. The vulnerability exists due to the stack-based buffer over-read in the filecopystr function of funcs.c, which allows an attacker to cause an application crash through a maliciously crafted input...

5.5CVSS6.8AI score0.00677EPSS
SaveExploits1References12Affected Software1
Veracode
Veracode
•added 2023/10/09 2:34 p.m.•39 views

Denial Of Service (DoS)

qemu is vulnerable to Denial of Service DoS. A Division by Zero vulnerability allows local attackers to crash QEMU and the guest operating system by sending a specially crafted SCSI command...

5.5CVSS6.3AI score0.00376EPSS
SaveExploits1References5Affected Software1
Veracode
Veracode
•added 2023/09/01 4:04 p.m.•39 views

Denial Of Service (DoS)

wireshark is vulnerable to Denial of Service DoS attacks. The vulnerability exists in the packet-cp2179.c file. The file is responsible for decoding CP2179 packets. The vulnerability occurs when the file fails to properly check the length of a packet. This can cause Wireshark to divide by zero,...

6.5CVSS6.7AI score0.02795EPSS
SaveExploits1References6Affected Software1
Veracode
Veracode
•added 2023/08/30 3:57 p.m.•39 views

Denial Of Service (DoS)

wireshark is vulnerable to Denial Of Service DoS. The vulnerability exists due to the infinite loop in the BT SDP dissector, which allows an attacker to cause an application crash via packet injection or crafted capture file...

7.5CVSS7.1AI score0.00463EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2023/08/24 9:57 a.m.•39 views

Arbitrary Code Execution

langchain is vulnerable to Arbitrary Code Execution. The vulnerability exists due to a lack of validation in the loadprompt parameter, which allows an attacker to execute malicious code into the system...

9.8CVSS7.3AI score0.0344EPSS
SaveExploits2References3Affected Software1
Veracode
Veracode
•added 2023/08/13 1:35 p.m.•39 views

Out-of-bounds Write

qemu is vulnerable to Out-of-bounds Write. This vulnerability occurs since there is no check for the value of 'srclen' and 'dstlen' in 'virtiocryptosymophelper' resulting in a heap-based buffer overflow...

6.5CVSS6.9AI score0.00233EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/08/06 11:23 p.m.•39 views

Improper Input Validation

chromium is vulnerable to Improper Input Validation. The vulnerability exists due to inappropriate implementation in Autofill in Google Chrome which allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

5.4CVSS6.3AI score0.00454EPSS
SaveExploits1References5Affected Software1
Veracode
Veracode
•added 2023/08/06 7:40 a.m.•39 views

NULL Pointer Dereference

libapache2-mod-auth-openidc is vulnerable NULL Pointer Dereference. This occurs when OIDCStripCookies is set and a creafted cookie is supplied resulting in a segmentation fault, causing to denial of service conditions...

7.5CVSS6.5AI score0.01327EPSS
SaveExploits0References8Affected Software1
Veracode
Veracode
•added 2023/08/06 7:40 a.m.•39 views

Denial Of Service (DoS)

Magick is vulnerable to Denial of Service DoS attacks. Applications using the DHcheck, DHcheckex, or EVPPKEYparamcheck methods to check a DH key or DH parameters may encounter lengthy delays. If the key or parameters being verified have come from an unreliable source, this might result in a Denia...

5.3CVSS6.8AI score0.03047EPSS
SaveExploits0References16Affected Software2
Veracode
Veracode
•added 2023/07/27 5:03 p.m.•39 views

Improper Filename Validation

Thunderbird is vulnerable to Improper Filename Validation. the vulnerability is due to a lack of preventing text direction override unicode characters in filename attachments. This can allow an attacker to attach an executable file, without the extension displayed as such...

7.5CVSS6.7AI score0.00669EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/07/27 1:58 p.m.•39 views

Information Disclosure

xen is vulnerable to Information Disclosure. Under specific micro architectural circumstances, an attacker is able to potentially access sensitive user information...

5.5CVSS6.7AI score0.05188EPSS
SaveExploits1References40Affected Software5
Veracode
Veracode
•added 2023/07/21 7:52 a.m.•39 views

Denial Of Service (DoS)

libfrr.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to the missing length checks in the bgpattrpsidsub function of bgpattr.c, allowing an attacker to cause an application crash by providing a maliciously crafted input...

7.5CVSS6.6AI score0.02152EPSS
SaveExploits1References8Affected Software2
Veracode
Veracode
•added 2023/07/20 10:29 a.m.•39 views

Denial Of Service (DoS)

gpac is vulnerable to Denial of Service DoS attacks. If keys or parameters are received from an unreliable source, applications employing DHcheck, DHcheckex, or EVPPKEYparamcheck may face lengthy delays, resulting in denial of service conditions...

5.3CVSS6.7AI score0.06531EPSS
SaveExploits0References20Affected Software3
Veracode
Veracode
•added 2023/07/19 1:25 a.m.•39 views

Improper Authentication

openssl is vulnerable to Improper Authentication. The vulnerability allows applications that use the 'AES-SIV' algorithm and want to authenticate empty data entries to be misled by removing adding or reordering empty entries causing the issue...

5.3CVSS6.8AI score0.00622EPSS
SaveExploits0References12Affected Software2
Veracode
Veracode
•added 2023/07/14 2:38 a.m.•39 views

Sandbox Escape

vm2 is vulnerable to Sandbox Escape. The vulnerability exists because the library does not properly sanitize a Promise return, allowing an attacker to escape the sandbox and inject and execute malicious code...

10CVSS7AI score0.03867EPSS
SaveExploits4References3Affected Software1
Veracode
Veracode
•added 2023/07/09 10:29 p.m.•39 views

Heap-Based Buffer Overflow

libjpeg-turbo is vulnerable to Heap-Based Buffer Overflow. A malicious attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples, the application attempting to decompress the image could lead to buffer overflows...

6.5CVSS6.8AI score0.0119EPSS
SaveExploits1References8Affected Software1
Veracode
Veracode
•added 2023/07/06 7:27 a.m.•39 views

Insecure TLS Configuration

io.quarkus:quarkus-vertx-http and io.quarkus:quarkus-grpc use Insecure TLS Configuration. The library fails to enforce the configured TLS protocol in quarkus.http.ssl.protocols, which lets a client choose a less secure protocol...

8.1CVSS6.8AI score0.00882EPSS
SaveExploits0References5Affected Software2
Veracode
Veracode
•added 2023/06/27 6:13 p.m.•39 views

Improper Input Validation

gitlab is vulnerable to Improper Input Validation. The vulnerability allows a malicious attacker to steal environment variables through the :sendmail delivery method via maliciously crafted email addresses...

7.5CVSS6.7AI score0.01477EPSS
SaveExploits0References4Affected Software1
Total number of security vulnerabilities5000