39248 matches found
OS Command Injection
patch is vulnerable to OS command injection. An attacker is able to execute arbitrary OS commands through patch using a malicious patch file containing ed style diff payload with shell metacharacters...
HTTP Response Splitting
webrick is vulnerable to HTTP response splitting. Lack of sanitization in the HTTP headers allow an attacker to inject CRLF characters and cause users to render malicious content. The exploit is possible when the application parses untrusted user input into an HTTP header in the response...
Information Disclosure
undertow is vulnerable to information disclosure. The vulnerability exists as the DEBUG log for io.undertow.request.security leaks credentials to log files if it is enabled...
Information Disclosure
cri-o is vulnerable to information disclosure. The vulnerability exists as it does not enforce TLS when sending username+password credentials to token servers leading to credential disclosure...
Denial Of Service (Dos)
libexpat.so is vulnerable to denial of service. A heap-based buffer overflow occurs when an attacker sends a malicious XML which switches the DTD parsing to document parsing immaturely, leading to repeated calls of XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber function that results in an...
Sandbox Restrictions Bypass
jenkins-plugin-script-security isv vulnerable to Sandbox bypass. This is possible through method pointer expressions in Script Security Plugin...
Improper Verification Of Cryptographic Signature
openpgp.js is performs improper verification of cryptographic signature. The vulnerability exists as openpgp.js incorrectly trusts unhashed signature subpackets...
Denial Of Service (DoS)
mysql is vulnerable to denial of service. A difficult to exploit vulnerability allows a high privileged attacker to crash the server...
Denial Of Service (DoS)
elfutils is vulnerable to denial of service. It is due to invalid memory address dereference occured in dwflsegmentreportmodule.c in libdwfl when an attacker passes a malicious ELF file...
Information Disclosure
kernel is vulnerable to information disclosure. The vulnerability exists through a heap address information leak while using L2CAPPARSECONFRSP...
Denial Of Service (DoS)
kernel is vulnerable to denial of service DoS. The vulnerability exists through vfio DMA mappings...
Privilege Escalation
kernel is vulnerable to privilege escalation. A use-after-free in the svcprocesscommon function allows an attacker to cause a host kernel memory corruption and a system panic, potentially resulting in a successful privilege escalation...
Denial Of Service (DoS)
Django is vulnerable to denial of service DoS. It does not properly handle HTML entities in the function striptags, causing excessive HTMLParser recursions...
Cross-Site Scripting (XSS)
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.117. See the following advisory for the container...
OS Command Injection
vim is vulnerable to OS command injection. The :source! command in a modeline allows remote attackers to execute arbitrary OS commands...
Cross-Site Request Forgery (CSRF)
phpMyAdmin is vulnerable to cross-site request forgery CSRF. The readCredentials function in AuthenticationCookie plugin uses $REQUEST instead of $POST. This allows an attacker to trick a user and deliver malicious payload, through statements such as INSERT or DELETE, to the victim...
Denial Of Service (DoS)
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.82. See the following advisory for the container...
Improper Signature Validation
Ruby is vulnerable to improper signature validation vulnerability. This occurs in the tarball in package.rb which allows to install mis-signed gem...
Denial Of Service (DoS)
Linux kernel is vulnerable to denial of serviceDoS attacks. The xfsdinodeverify function in fs/xfs/libxfs/xfsinodebuf.c in the Linux kernel could cause a NULL pointer dereference in xfsilockattrmapshared function. An attacker could exploit this by mounting a crafted xfs filesystem image to cause ...
Denial Of Service (DoS)
Linux kernel is vulnerable to denial of serviceDoS attacks. This is because Salsa20 encryption algorithm does not correctly handle zero-length inputs. This allows a local attacker to use the AFALG-based skcipher interface to cause a denial of service uninitialized-memory free and kernel crash or...
Memory Corruption
Linux kernel is vulnerable to memory corruption vulnerability. This is because the ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently causing an...
Denial Of Service (DoS)
PHP is vulnerable to denial of service DoS attacks. The vulnerability exists in the ext/intl/msgformat/msgformatformat.c in PHP. Remote attackers could cause a denial of service or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument...
Denial Of Service (DoS)
Oracle MySQL is vulnerable to denial of serviceDoS attacks. A remote user could exploit a flaw in the Client programs component which leads to unauthorized attacker to cause a hang or frequently repeatable crash complete DoS...
Denial Of Service (DoS)
Oracle Java SE is vulnerable to denial of service DoS attacks. The vulnerability exists in an unknown function of the component Security. An unauthenticated attacker with network access via multiple protocols could compromise Java SE, Java SE Embedded, JRockit causing a parital denial of service...
Denial Of Service (DoS)
Linux kernel is vulnerable to denial of service attacks. A local authenticated attacker could cause denial of service conditions or possibly have unspecified other impact by triggering a negative wake or requeue value. Affected by this issue is the function futexrequeue of the file kernel/futex.c...
Denial Of Service (DoS)
Linux kernel is vulnerable to denial of serviceDoS attacks. This occurs in implementation of associative arrays where the addkey systemcall and KEYCTLUPDATE operations allowed for a NULL payload with a nonzero length. When accessing the payload within this length parameters value, an unprivileged...
Information Disclosure
MySQL is vulnerable to information disclosure vulnerability. A low privileged attacker with network access via multiple protocols could compromise MySQL Server resulting in unauthorized read access to a subset of MySQL Server accessible data...
Denial Of Service (DoS)
Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the...
Information Disclosure
Pidgin is vulnerable to information disclosure. A remote unauthenticated attacker could exploit the vulnerable XMPP Message Handler component and obtain sensitive information from process memory via a crafted XMPP message...
Arbitrary Code Execution
OpenJPEG is vulnerable to arbitrary code execution attacks. A remote unauthenticated attacker could exploit the vulnerable JP2 File Handler component to cause code execution via a crafted JP2 file, which triggers an out-of-bounds read or write...
Privilege Escalation
Oracle MySQL is vulnerable to privilege escalation attacks. A remote, authenticated attacker could insert malicious input leading to the exploitation of the flawed Client programs component to gain elevated privileges. Successful attacks could result in unauthorized access to critical data or...
Man-In-The-Middle
Oracle MySQL is vulnerable to man-in-the-middle attacks. The attacker could hijack client's authentication to the server even if the client was configured to require SSL connection since MySQL client command line tools only checks after authentication whether server supported SSL. Affected...
Denial Of Service (DoS) Through Double-free
Linux kernel is vulnerable to denial of service DoS through double-free vulnerability. This vulnerability exists in the inetcskclonelock function in net/ipv4/inetconnectionsock.c in the Linux kernel. Attackers could cause a denial of service or possibly have unspecified other impact by leveraging...
Path Traversal
Red Hat JBoss Enterprise Application is vulnerable to path traversal attacks. The attacks are possible because the application fails to sufficiently sanitize user-supplied input. Remote attackers may use a specially crafted request with directory-traversal sequences to read arbitrary files...
Denial Of Service (DoS)
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. T...
Privilege Escalation
Oracle MySQL, MariaDB, Percona Server and Percona XtraDB Cluster are vulnerable to privilege escalation. A locally authenticated attacker may use race condition while setting stats during MyISAM table repair to obtain elevated privileges...
Denial Of Service (DoS)
libtiff is vulnerable to denial of service DoS attacks. This allows remote attackers to affect the availability via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif...
Integer Overflow
Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or...
Denial Of Service (DoS)
Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or...
Sensitive Information Leak
ntp is vulnerable to sensitive information disclosure. It is possible due to missing validation of vallen value in ntpcrypto.c when the decryption of a secret received from an NTP server is performed, leading to a stack-based buffer overflow and crashing the NTP client...
Privilege Escalation
The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way Linux kernel's Transparent Huge Pages THP implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent...
Symlink Attack
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Ja...
Arbitrary Code Execution
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Ja...
Symlink Attack
ABRT Automatic Bug Reporting Tool is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. It was found that ABRT was vulnerable to multiple race condition...
Arbitrary Code Execution
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
Out-of-bounds Read
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
Improper Input Validation
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 collection provide a stable release of Python 2.7 with a number of additional utilities and database connectors f...
Improper Input Validation
Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 collection provide a stable release of Python 2.7 with a number of additional utilities and database connectors f...