Lucene search
+L
VeracodeMost viewed

38790 matches found

Veracode
Veracode
•added 2023/12/26 12:49 p.m.•39 views

Insufficient Verification Of Data Authenticity

exim4 library is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to insufficient verification Exim's SMTP server configurations as it support a character sequence . in SMTP transactions, which is not universally supported by other popular email servers. This...

5.3CVSS7.1AI score0.01081EPSS
SaveExploits1References21Affected Software2
Veracode
Veracode
•added 2023/12/26 12:49 p.m.•39 views

SMTP Smuggling

Postfix is vulnerable to SMTP smuggling. The vulnerability is caused due to support for . while handling line endings. A remote attacker can exploit this using published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection...

5.3CVSS6.7AI score0.02598EPSS
SaveExploits4References18Affected Software1
Veracode
Veracode
•added 2023/12/25 2:03 p.m.•39 views

Directory Traversal

Asterisk is vulnerable to Directory Traversal. The vulnerability arises because it allows the reading of any arbitrary file, even when the livedangerously setting is not enabled.This allows arbitrary files to be read...

7.5CVSS6.8AI score0.4557EPSS
SaveExploits3References5Affected Software1
Veracode
Veracode
•added 2023/12/21 9:16 a.m.•39 views

Command Injection

libssh.so is vulnerable to Command Injection. The vulnerability is due to insufficient validation of the hostname parameter in the URI parsing process. This allows attackers to use ProxyCommand or the ProxyJump features to exploit and inject malicious code via the unchecked hostname parameter on...

4.8CVSS7AI score0.00449EPSS
SaveExploits0References9Affected Software2
Veracode
Veracode
•added 2023/12/15 5:01 a.m.•39 views

Heap Buffer Overflow

chromium:sid is vulnerable to Heap buffer overflow. The vulnerability due to Type confusion can accessing a resource with an incompatible type, leading to logical errors and type-related issues.. It allow a remote attacker to potentially exploit heap corruption via a crafted HTML page...

8.8CVSS6.9AI score0.43795EPSS
SaveExploits1References5Affected Software3
Veracode
Veracode
•added 2023/12/15 5:01 a.m.•39 views

Buffer Overflow

chromium:sid is vulnerable to buffer overflow. The vulnerability due to to access a memory location after the memory has been freed or deallocated. It allow a remote attacker to potentially exploit heap corruption via a crafted HTML page...

8.8CVSS6.9AI score0.00645EPSS
SaveExploits0References5Affected Software2
Veracode
Veracode
•added 2023/11/29 9:58 a.m.•39 views

Denial Of Service

Reactor Netty HTTP Server is vulnerable to Denial Of Service DOS. The vulnerability is due to the improper validation of HTTP requests while if the micrometer integration is enabled, which can result in Denial Of Service...

7.5CVSS6.9AI score0.00914EPSS
SaveExploits0References3Affected Software2
Veracode
Veracode
•added 2023/11/29 7:59 a.m.•39 views

Denial Of Service (DoS)

Spring Boot is vulnerable to Denial Of Service. The vulnerability is due to parsing malicious HTTP Request without proper validation or sanitization. This issue can be exploited by an attacker via crafting mailicous HTTP Request leading to Denial Of Service. Note that the following conditions mus...

6.5CVSS7AI score0.01219EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/11/02 9:55 p.m.•39 views

Cross-site Scripting (XSS)

chromium is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the inappropriate implementation in Payments, which allows an attacker to bypass XSS preventions via a malicious file...

6.1CVSS6.7AI score0.01109EPSS
SaveExploits0References10Affected Software1
Veracode
Veracode
•added 2023/11/02 6:39 p.m.•39 views

Domain Spoofing

chromium is vulnerable to Domain Spoofing. The vulnerability occurs due to incorrect security UI in Picture In Picture within google chrome which allows a remote malicious attacker to perform domain spoofing via a crafted local HTML page...

4.3CVSS6.7AI score0.00625EPSS
SaveExploits0References10Affected Software1
Veracode
Veracode
•added 2023/10/29 10:30 a.m.•39 views

Buffer Overflows

memcached is vulnerable to Buffer Overflows. An attacker could exploit this vulnerability by sending a specially crafted multiget request to a vulnerable Memcached server when there are many spaces after the "get" substring for multiget requests in proxy mode. The server would then attempt to...

7.5CVSS7.9AI score0.00778EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/10/12 2:31 p.m.•39 views

Information Disclosure

tomcat-catalina is vulnerable to information disclosure. This vulnerability exists due to an improper request recycling mechanism, allowing an attacker to possibly access other requests...

5.3CVSS6.5AI score0.0216EPSS
SaveExploits1References10Affected Software2
Veracode
Veracode
•added 2023/10/11 3:55 a.m.•39 views

Buffer Overflow

libfile.so is vulnerable to Buffer Overflow. The vulnerability exists due to the stack-based buffer over-read in the filecopystr function of funcs.c, which allows an attacker to cause an application crash through a maliciously crafted input...

5.5CVSS6.8AI score0.00677EPSS
SaveExploits1References12Affected Software1
Veracode
Veracode
•added 2023/10/09 2:34 p.m.•39 views

Denial Of Service (DoS)

qemu is vulnerable to Denial of Service DoS. A Division by Zero vulnerability allows local attackers to crash QEMU and the guest operating system by sending a specially crafted SCSI command...

5.5CVSS6.3AI score0.00376EPSS
SaveExploits1References5Affected Software1
Veracode
Veracode
•added 2023/10/08 6:05 a.m.•39 views

Denial Of Service (DoS)

wireshark is vulnerable to Denial of Service DoS. A memory leak in the RTPS dissector allows a remote attacker to cause a denial of service DoS attack by sending a specially crafted RTPS packet...

6.5CVSS6.6AI score0.00485EPSS
SaveExploits1References6Affected Software1
Veracode
Veracode
•added 2023/09/01 4:04 p.m.•39 views

Denial Of Service (DoS)

wireshark is vulnerable to Denial of Service DoS attacks. The vulnerability exists in the packet-cp2179.c file. The file is responsible for decoding CP2179 packets. The vulnerability occurs when the file fails to properly check the length of a packet. This can cause Wireshark to divide by zero,...

6.5CVSS6.7AI score0.02795EPSS
SaveExploits1References6Affected Software1
Veracode
Veracode
•added 2023/08/30 3:57 p.m.•39 views

Denial Of Service (DoS)

wireshark is vulnerable to Denial Of Service DoS. The vulnerability exists due to the infinite loop in the BT SDP dissector, which allows an attacker to cause an application crash via packet injection or crafted capture file...

7.5CVSS7.1AI score0.00463EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2023/08/24 9:57 a.m.•39 views

Arbitrary Code Execution

langchain is vulnerable to Arbitrary Code Execution. The vulnerability exists due to a lack of validation in the loadprompt parameter, which allows an attacker to execute malicious code into the system...

9.8CVSS7.3AI score0.0344EPSS
SaveExploits2References3Affected Software1
Veracode
Veracode
•added 2023/08/13 1:35 p.m.•39 views

Out-of-bounds Write

qemu is vulnerable to Out-of-bounds Write. This vulnerability occurs since there is no check for the value of 'srclen' and 'dstlen' in 'virtiocryptosymophelper' resulting in a heap-based buffer overflow...

6.5CVSS6.9AI score0.00233EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/08/06 11:23 p.m.•39 views

Improper Input Validation

chromium is vulnerable to Improper Input Validation. The vulnerability exists due to inappropriate implementation in Autofill in Google Chrome which allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

5.4CVSS6.3AI score0.00454EPSS
SaveExploits1References5Affected Software1
Veracode
Veracode
•added 2023/08/06 7:40 a.m.•39 views

NULL Pointer Dereference

libapache2-mod-auth-openidc is vulnerable NULL Pointer Dereference. This occurs when OIDCStripCookies is set and a creafted cookie is supplied resulting in a segmentation fault, causing to denial of service conditions...

7.5CVSS6.5AI score0.01327EPSS
SaveExploits0References8Affected Software1
Veracode
Veracode
•added 2023/08/06 7:40 a.m.•39 views

Denial Of Service (DoS)

Magick is vulnerable to Denial of Service DoS attacks. Applications using the DHcheck, DHcheckex, or EVPPKEYparamcheck methods to check a DH key or DH parameters may encounter lengthy delays. If the key or parameters being verified have come from an unreliable source, this might result in a Denia...

5.3CVSS6.8AI score0.03047EPSS
SaveExploits0References16Affected Software2
Veracode
Veracode
•added 2023/07/27 5:03 p.m.•39 views

Improper Filename Validation

Thunderbird is vulnerable to Improper Filename Validation. the vulnerability is due to a lack of preventing text direction override unicode characters in filename attachments. This can allow an attacker to attach an executable file, without the extension displayed as such...

7.5CVSS6.7AI score0.00669EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/07/27 1:58 p.m.•39 views

Information Disclosure

xen is vulnerable to Information Disclosure. Under specific micro architectural circumstances, an attacker is able to potentially access sensitive user information...

5.5CVSS6.7AI score0.05188EPSS
SaveExploits1References40Affected Software5
Veracode
Veracode
•added 2023/07/21 7:52 a.m.•39 views

Denial Of Service (DoS)

libfrr.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to the missing length checks in the bgpattrpsidsub function of bgpattr.c, allowing an attacker to cause an application crash by providing a maliciously crafted input...

7.5CVSS6.6AI score0.02152EPSS
SaveExploits1References8Affected Software2
Veracode
Veracode
•added 2023/07/20 10:29 a.m.•39 views

Denial Of Service (DoS)

gpac is vulnerable to Denial of Service DoS attacks. If keys or parameters are received from an unreliable source, applications employing DHcheck, DHcheckex, or EVPPKEYparamcheck may face lengthy delays, resulting in denial of service conditions...

5.3CVSS6.7AI score0.06531EPSS
SaveExploits0References20Affected Software3
Veracode
Veracode
•added 2023/07/19 1:25 a.m.•39 views

Improper Authentication

openssl is vulnerable to Improper Authentication. The vulnerability allows applications that use the 'AES-SIV' algorithm and want to authenticate empty data entries to be misled by removing adding or reordering empty entries causing the issue...

5.3CVSS6.8AI score0.00622EPSS
SaveExploits0References12Affected Software2
Veracode
Veracode
•added 2023/07/14 9:36 a.m.•39 views

Path Traversal

apacheairflow is vulnerable to Path Traversal. The vulnerability exists because the DagRun.runid parameter is not properly sanitized which allows an attacker to gain access to unauthorized files outside the intended directory...

6.5CVSS7AI score0.01787EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/07/14 2:38 a.m.•39 views

Sandbox Escape

vm2 is vulnerable to Sandbox Escape. The vulnerability exists because the library does not properly sanitize a Promise return, allowing an attacker to escape the sandbox and inject and execute malicious code...

10CVSS7AI score0.03867EPSS
SaveExploits4References3Affected Software1
Veracode
Veracode
•added 2023/07/09 10:29 p.m.•39 views

Heap-Based Buffer Overflow

libjpeg-turbo is vulnerable to Heap-Based Buffer Overflow. A malicious attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples, the application attempting to decompress the image could lead to buffer overflows...

6.5CVSS6.8AI score0.0119EPSS
SaveExploits1References8Affected Software1
Veracode
Veracode
•added 2023/07/06 7:27 a.m.•39 views

Insecure TLS Configuration

io.quarkus:quarkus-vertx-http and io.quarkus:quarkus-grpc use Insecure TLS Configuration. The library fails to enforce the configured TLS protocol in quarkus.http.ssl.protocols, which lets a client choose a less secure protocol...

8.1CVSS6.8AI score0.00882EPSS
SaveExploits0References5Affected Software2
Veracode
Veracode
•added 2023/06/27 6:13 p.m.•39 views

Improper Input Validation

gitlab is vulnerable to Improper Input Validation. The vulnerability allows a malicious attacker to steal environment variables through the :sendmail delivery method via maliciously crafted email addresses...

7.5CVSS6.7AI score0.01477EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/06/15 2:48 a.m.•39 views

Code Injection

nifi-hikari-dbcp-service and nifi-dbcp-base is vulnerable to Code Injection. The vulnerability exists due to improper URL validation for the database services, if an attacker has access to the database URL, an attacker can inject and execute malicious code by configuring an H2 driver...

8.8CVSS7.3AI score0.63633EPSS
SaveExploits10References10Affected Software2
Veracode
Veracode
•added 2023/05/25 2:04 a.m.•39 views

Remote Code Execution (RCE)

RocketMQ is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library allows updating the config path at runtime, allowing an attacker to inject and execute malicious code through the update configuration function by forging the RocketMQ protocol content, which also...

9.8CVSS7.5AI score0.96604EPSS
SaveExploits11References9Affected Software3
Veracode
Veracode
•added 2023/05/17 4:33 a.m.•39 views

Reflected File Download

github.com/gin-gonic/gin is vulnerable to Reflected File Download. The vulnerability exists because the FileAttachment function of context.go does not properly sanitize the filename parameter, which allows an attacker to modify the Content-Disposition header and replace the .txt file name suffix...

4.3CVSS6.7AI score0.00486EPSS
SaveExploits2References6Affected Software1
Veracode
Veracode
•added 2023/05/12 11:29 p.m.•39 views

Improper Input Validation

OpenJDK is vulnerable to Improper Input Validation. An attacker can update, insert or delete access to some of Oracle Java SE and Oracle GraalVM Enterprise Edition accessible data through multiple protocols...

3.7CVSS6.5AI score0.01218EPSS
SaveExploits0References12Affected Software9
Veracode
Veracode
•added 2023/05/08 3:39 p.m.•39 views

Denial Of Services (DoS)

Netatalk is vulnerable to Denial Of Services DoS. The vulnerability exists due to the heap-based buffer overflow in afpgetappl, resulting in code execution through the .appl file, allowing an attacker to cause an application crash and access root on some platforms such as FreeBSD used for TrueNAS...

7.8CVSS9.1AI score0.00606EPSS
SaveExploits1References15Affected Software1
Veracode
Veracode
•added 2023/04/30 10:30 a.m.•39 views

Denial Of Service (DoS)

frr is vulnerable to Denial of Service DoS. The vulnerability relies on a reachable assertion found within 'peekforas4capability' function. A malicious attacker may use this to construct and send BGP open packets to BGP peers causing a denial of serivce...

7.5CVSS7.1AI score0.01638EPSS
SaveExploits1References11Affected Software1
Veracode
Veracode
•added 2023/04/27 4:10 a.m.•39 views

Password Disclosure

apache-superset is vulnerable to Password Disclosure. An authenticated user with specific data permissions could access database connections and stored passwords by requesting a specific REST API...

6.5CVSS6.2AI score0.02067EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2023/04/19 4:35 p.m.•39 views

Information Disclosure

github.com/authzed/spicedb is vulnerable to Information Disclosure. The vulnerability exists in the MetricsHandler function in defaults.go because it exposes the --grpc-preshared-key flag in the spicedb serve command which allows an attacker to gain access to the secret key and preform unauthoriz...

8.7CVSS7.5AI score0.00762EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
•added 2023/04/19 8:22 a.m.•39 views

Command Injection

net.snowflake:snowflake-jdbc is vulnerable to Command Injection. The vulnerability exists due to improper input sanitizations in the openBrowser function of SessionUtilExternalBrowser.java. An attacker is able to set up a malicious server to respond to an SSO URL with a malicious payload, leading...

8.8CVSS8.8AI score0.01668EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2023/04/19 7:05 a.m.•39 views

Denial Of Services (DoS)

Google Chrome is vulnerable to Denial Of Services DoS. The vulnerability exists due to the heap buffer overflow in Browser History, which allows an attacker to convince a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page...

8.8CVSS8.7AI score0.00975EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2023/04/04 9:55 a.m.•39 views

Prototype Pollution

matrix-js-sdk is vulnerable to Prototype Pollution. Events sent with special strings in key places may disrupt or impede the library from functioning properly, potentially impacting the consumer's ability to process data safely...

8.2CVSS7.8AI score0.01185EPSS
SaveExploits0References6Affected Software3
Veracode
Veracode
•added 2023/03/12 9:55 a.m.•39 views

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the Web Payments API, which allows an attacker to compromise the renderer process to potentially exploit heap corruption via a crafted HTML page, leading to an application crash...

8.8CVSS8.7AI score0.00579EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/03/12 9:55 a.m.•39 views

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the SwiftShader, which allows an attacker to potentially exploit heap corruption via a crafted HTML page, leading to an application crash...

8.8CVSS8.7AI score0.006EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2023/03/11 9:44 p.m.•39 views

XML External Entity (XXE)

php-dompdf is vulnerable to XML External Entity XXE attacks. SVG images are not processed through Dompdf's resource validation logic, allowing attackers to use remote resources, local filesystem paths, and vulnerable protocols without restriction...

9.8CVSS6.1AI score0.00951EPSS
SaveExploits1References3Affected Software1
Veracode
Veracode
•added 2023/03/09 9:02 p.m.•39 views

Privilege Escalation

systemd is vulnerable to Privilege Escalation. The vulnerability occurs because systemd does not set 'LESSSECURE' to 1 and due to this programs can be launched from the less program without privileges. This can be exploited when running systemctl from Sudo, since less executes as root when the...

7.8CVSS7.3AI score0.01051EPSS
SaveExploits4References8Affected Software1
Veracode
Veracode
•added 2023/03/08 11:33 a.m.•39 views

Information Disclosure

github.com/moby/buildkit is vulnerable to Information Disclosure. When a build request contains a Git URL with credentials, anyone with access to the build provenance attestation will be able to view the credentials issued. An attacker can use these Git credentials to access repositories...

6.5CVSS6.2AI score0.01026EPSS
SaveExploits1References7Affected Software2
Veracode
Veracode
•added 2023/03/06 8:47 p.m.•39 views

Use-After-Free

Linux Kernel is vulnerable to Use-After-Free. A bug available in 'icskulpdata' of 'inetconnectionsock'. If 'CONFIGTLS' is enabled, an attacker could install a tls context leading to privilege escalation...

7.8CVSS7.5AI score0.00652EPSS
SaveExploits0References6Affected Software4
Veracode
Veracode
•added 2023/02/25 8:47 p.m.•39 views

Privilege Escalation

haproxy, buster is vulnerable to Privilege Escalation. An attacker is able to change their resource allocations, promote containers to privileged mode, or potentially add ssh authorized keys to a remote shell on the target machine by creating new files on the host system. In order for an attacker...

9.1CVSS8.7AI score0.05493EPSS
SaveExploits0References10Affected Software4
Total number of security vulnerabilities5000