Lucene search
+L
VeracodeMost viewed

38838 matches found

Veracode
Veracode
•added 2019/01/15 9:19 a.m.•41 views

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the pivotroot implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service...

5.5CVSS5.5AI score0.00673EPSS
SaveExploits1References52Affected Software1
Veracode
Veracode
•added 2019/01/15 9:18 a.m.•41 views

Denial Of Service (DoS)

ghostscript is vulnerable to denial of service DoS attacks. The vulnerability exists as the memgetbitsrectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted PostScript document...

5.5CVSS7AI score0.02293EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2019/01/15 9:16 a.m.•41 views

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the ext4fillsuper function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service out-of-bound...

4.3CVSS5.1AI score0.00428EPSS
SaveExploits0References3Affected Software1
Veracode
Veracode
•added 2019/01/15 9:16 a.m.•41 views

Denial Of Service (DoS)

QEMU is vulnearble to denial of service. An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance...

5.5CVSS6.6AI score0.00513EPSS
SaveExploits0References29Affected Software1
Veracode
Veracode
•added 2019/01/15 9:15 a.m.•41 views

Weak Encryption

The DES and Triple-DES ciphers are vulnerable to birthday attacks, allowing a malicious user to decrypt and obtain cleartext data faster than a standard brute-force attack...

7.5CVSS7.5AI score0.95707EPSS
SaveExploits7References148Affected Software11
Veracode
Veracode
•added 2019/01/15 9:14 a.m.•41 views

Denial Of Service (DoS)

gstreamer-plugins-bad-free is vulnerable to denial of service DoS attacks. The vulnerability exists as an integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service crash via large width and height values, which triggers a buffer overflow...

7.5CVSS7.4AI score0.03691EPSS
SaveExploits0References12Affected Software1
Veracode
Veracode
•added 2019/01/15 9:14 a.m.•41 views

Cross-site Scripting (XSS) Via Dialog CloseText

jquery-ui is vulnerable to cross-site scripting XSS attacks. A malicious user can execute arbitrary code to the closeText parameter of the dialog function...

6.1CVSS6.7AI score0.2258EPSS
SaveExploits1References38Affected Software2
Veracode
Veracode
•added 2019/01/15 9:13 a.m.•41 views

Regular Expression Denial Of Service (ReDoS) Via Long String Of Semicolons

tough-cookie is vulnerable to regular expression denial-of-service ReDoS attack. A malicious user can pass a long string that contains many semicolons in the Set-Cookies header, causing a regular expression to take a large amount of time, causing a denial of service condition...

5.3CVSS5.7AI score0.02356EPSS
SaveExploits0References9Affected Software3
Veracode
Veracode
•added 2019/01/15 9:12 a.m.•41 views

Arbitrary Code Execution

IBM Java is vulnerable to arbitrary code execution. An unspecified vulnerability allows an local users to affect confidentiality, integrity, and availability via vectors related to Deployment...

7.7CVSS8.4AI score0.00507EPSS
SaveExploits0References24Affected Software2
Veracode
Veracode
•added 2019/01/15 9:12 a.m.•41 views

Authorization Bypass

httpd is vulnerable to authorization bypass. It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for...

7.5CVSS7.3AI score0.18802EPSS
SaveExploits0References40Affected Software1
Veracode
Veracode
•added 2019/01/15 9:12 a.m.•41 views

Denial Of Service (DoS)

nginx is vulnerable to denial of service. It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if...

7.5CVSS7.9AI score0.81958EPSS
SaveExploits0References12Affected Software1
Veracode
Veracode
•added 2019/01/15 9:11 a.m.•41 views

Deserialization Of Untrusted Data

Apache ActiveMQ allows for deserialization of objects both in the Broker and in any applications which process ObjectMessage messages, specifically by using ObjectMessagegetObject. Broker deserialization happens in HTTP, Stop, Web Console, and other components. The deserialization in versions 5.0...

9.8CVSS8.4AI score0.38191EPSS
SaveExploits4References42Affected Software19
Veracode
Veracode
•added 2019/01/15 9:10 a.m.•41 views

Arbitrary Code Execution

git is vulnerable to arbitrary code execution. An integer truncation flaw and an integer overflow flaw, both leading to a heap-based buffer overflow, were found in the way Git processed certain path information. A remote attacker could create a specially crafted Git repository that would cause a...

9.8CVSS9.8AI score0.17312EPSS
SaveExploits0References28Affected Software2
Veracode
Veracode
•added 2019/01/15 9:07 a.m.•41 views

Denial Of Service (DoS)

httpd is vulnerable to denial of service. The modlua httpd module improperly processed certain WebSocket Ping requests, allowing a remote attacker to cause the httpd child process to crash via a malicious WebSocket Ping request...

5CVSS8.7AI score0.16472EPSS
SaveExploits0References42Affected Software1
Veracode
Veracode
•added 2019/01/15 9:07 a.m.•41 views

Denial Of Service (DoS)

net-snmp is vulnerable to denial of service. It was discovered that the snmppduparse function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or, potentially, execute arbitrary code on the system wit...

7.5CVSS8.3AI score0.40879EPSS
SaveExploits3References31Affected Software1
Veracode
Veracode
•added 2019/01/15 9:06 a.m.•41 views

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. These attacks can be triggered through the length field in ASN1TIME data via X509cmptime function in crypto/x509/x509vfy.c, causing an out-of-bounds read and an application crash...

7.5CVSS7.3AI score0.74483EPSS
SaveExploits0References61Affected Software1
Veracode
Veracode
•added 2019/01/15 9:01 a.m.•41 views

Sensitive Information Leakage

The kernel-rt packages is susceptible to denial of service DoS. The attack is possible because it does not make sure the addrlen value to get initialized with the associated data structure, allowing a local unauthorized user to do the recvmsg, recvfrom, and recvmmsg system calls to leak kernel...

4.9CVSS6.6AI score0.00461EPSS
SaveExploits0References34Affected Software1
Veracode
Veracode
•added 2019/01/15 9:01 a.m.•41 views

Denial Of Service

PostgreSQL is vulnerable to denial of service DoS attack. The attack exists because of failure to have proper the enumrecv function declaration in backend/utils/adt/enum.c causes an array index error, leading to a heap-based out-of-bounds buffer read flaw. Therefore, an unprivileged database user...

6.8CVSS6.4AI score0.03592EPSS
SaveExploits0References24Affected Software2
Veracode
Veracode
•added 2019/01/15 9:01 a.m.•41 views

Denial Of Service (DoS)

firefox is vulnerable to denial of service DoS attacks. The vulnerability exists as multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and...

10CVSS9.8AI score0.05238EPSS
SaveExploits0References16Affected Software3
Veracode
Veracode
•added 2019/01/15 9:01 a.m.•41 views

Denial Of Service (DoS)

qemu-kvm is vulnerable to denial of service DoS attacks. The vulnerability exists as QEMU, possibly before 2.0.0, allows local users to cause a denial of service divide-by-zero error and crash via a zero value in the 1 tracks field to the seektosector function in block/parallels.c or 2 extentsize...

5.5CVSS6.2AI score0.00382EPSS
SaveExploits0References14Affected Software2
Veracode
Veracode
•added 2019/01/15 9:00 a.m.•41 views

Man In The Middle (MitM) Attacks Are Possible With Spoofed SSL Servers

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

5.8CVSS7.7AI score0.05722EPSS
SaveExploits1References18Affected Software1
Veracode
Veracode
•added 2019/01/15 8:58 a.m.•41 views

Denial Of Service (DoS)

kernel-rt is vulnerable to denial of service DoS attacks. The vulnerability exists as the nfs4getacluncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cau...

4.6CVSS6.9AI score0.00979EPSS
SaveExploits2References18Affected Software1
Veracode
Veracode
•added 2019/01/15 8:57 a.m.•41 views

Denial Of Service (DoS)

libxml2 is vulnerable to denial of service DoS attacks. The vulnerability exists as an off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact v...

6.8CVSS6.5AI score0.0263EPSS
SaveExploits0References23Affected Software2
Veracode
Veracode
•added 2019/01/15 8:56 a.m.•41 views

Cross-site Request Forgery (CSRF)

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

4.3CVSS9.1AI score0.09146EPSS
SaveExploits1References27Affected Software3
Veracode
Veracode
•added 2019/01/15 8:53 a.m.•41 views

Arbitrary File Overwrite

hplip3 is vulnerable to arbitrary file overwrite attacks. The vulnerability exists as the senddatatostdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing HPLIP 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out...

1.2CVSS5.8AI score0.00444EPSS
SaveExploits0References17Affected Software2
Veracode
Veracode
•added 2019/01/15 8:52 a.m.•41 views

Timing Side- Channel Attack

OpenSSL is vulnerable to timing attacks. It happens because of lack of validation of MAC addresses in constant time during the processing of a malformed CBC padding. It is also known as "Lucky Thirteen" issue...

2.6CVSS6.4AI score0.35584EPSS
SaveExploits1References58Affected Software4
Veracode
Veracode
•added 2019/01/15 8:51 a.m.•41 views

Denial Of Service (DoS)

coreutils is vulnerable to denial of service. The sort, uniq, and join utilities did not properly restrict the use of the alloca function, which allows an attacker to crash those utilities in a stack-based buffer overflow by providing long input strings...

4.3CVSS6.2AI score0.07238EPSS
SaveExploits2References17Affected Software1
Veracode
Veracode
•added 2019/01/15 8:51 a.m.•41 views

Unspecified Flaw

Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw in an NVIDIA driver, which has unknown impact and attack vectors...

10CVSS9AI score0.0366EPSS
SaveExploits0References16Affected Software3
Veracode
Veracode
•added 2018/12/12 4:05 a.m.•41 views

Remote Code Execution (RCE)

Microsoft.ChakraCore is vulnerable to remote code execution. This is due to an out-of-bounds in Edge WIP which would allow an attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2018-8583, CVE-2018-8617, CVE-2018-8618, CVE-2018-8624...

7.5CVSS7.5AI score0.62483EPSS
SaveExploits4References3Affected Software2
Veracode
Veracode
•added 2018/11/30 5:44 a.m.•41 views

Denial Of Service (DoS)

node is vulnerable to denial of service DoS attacks. The vulnerability exists when a malicious user sends headers while keeping HTTP/HTTPS connections alive for a long period of time...

7.5CVSS7.3AI score0.41288EPSS
SaveExploits0References6Affected Software5
Veracode
Veracode
•added 2018/11/15 6:59 a.m.•41 views

Remote Code Execution (RCE)

Microsoft.ChakraCore is vulnerable to a remote code execution RCE attack. The library does not properly handle objects in the memory, causing a memory corruption exception that can allow a malicious user to inject and execute arbitrary code...

7.5CVSS8.2AI score0.14159EPSS
SaveExploits0References4Affected Software2
Veracode
Veracode
•added 2018/11/09 5:47 a.m.•41 views

Replay Attack

tomcat-util is vulnerable to replay attacks. The vulnerability exists due to the improper handling of empty requests to the SSL port, allowing a duplicate copy of a recent request to be replayed...

4.3CVSS4.6AI score0.05373EPSS
SaveExploits1References32Affected Software2
Veracode
Veracode
•added 2018/11/05 6:01 a.m.•41 views

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service attacks. The vulnerability exists due to an infinite loop that could occur in the printIFDStructure function of image.cpp which allows an attacker to crash the application...

6.5CVSS6.9AI score0.01987EPSS
SaveExploits1References3Affected Software5
Veracode
Veracode
•added 2018/10/09 6:23 a.m.•41 views

Denial Of Service (DoS)

libnetsnmp.so is vulnerable to denial of service DoS attacks. A malicious user can pass a GetNext PDU with multiple Varbinds to the application, causing a NULL Pointer Exception that can crash the application...

6.5CVSS6.3AI score0.17189EPSS
SaveExploits2References13Affected Software1
Veracode
Veracode
•added 2018/09/24 7:23 a.m.•41 views

Man-in-the-Middle (MitM)

node.js is vulnerable to a man-in-the-middle MitM attack. The library does not properly handle the wildcard character in the X.509 Certificate namefields. This can allow a malicious user to spoof servers and cause a MitM attack...

5.9CVSS5.9AI score0.02841EPSS
SaveExploits0References2Affected Software4
Veracode
Veracode
•added 2018/08/07 9:27 a.m.•41 views

Sensitive Information Leakage

IdentityServer3 is vulnerable to sensitive information leakage. The leakage of identityserver responses is possible because there is a flaw in Angular expression on the authorize response page...

6.1CVSS6AI score0.01042EPSS
SaveExploits0References2Affected Software1
Veracode
Veracode
•added 2018/07/20 8:31 a.m.•41 views

TLS Session Resumption Client Certificate Bypass

libcurl.so is vulnerable to TLS session resumption client certificate bypass attacks. The vulnerability exists in Curlclonesslconfig of lib/vtls/vtls.c where libcurl.so does not prevent the TLS session resumption if the client certificate has been replaced...

7.5CVSS7.6AI score0.15893EPSS
SaveExploits0References21Affected Software1
Veracode
Veracode
•added 2018/05/30 8:56 a.m.•41 views

Remote Code Execution (RCE)

icu4c is vulnerable to remote code execution RCE attacks. A malicious user can pass a string to the application to cause a double free that can crash the application or cause arbitrary code to be executed...

9.8CVSS9.7AI score0.05096EPSS
SaveExploits0References4Affected Software1
Veracode
Veracode
•added 2018/04/18 7:09 a.m.•41 views

Denial Of Service (DoS) Through Stack Buffer Overflow

libarchive.so is vulnerable to denial of service DoS through stack-based buffer overflow attacks. The vulnerability exists in safefprintf of tar/util.c when printing a filename can cause a buffer overflow when formatting a non-printable multi-byte character...

7.5CVSS7.8AI score0.05258EPSS
SaveExploits0References2Affected Software1
Veracode
Veracode
•added 2018/04/12 4:38 p.m.•41 views

Denial Of Service (DoS) Through NULL Pointer Dereference

libtiff.so is vulnerable to denial of service DoS through null pointer dereference. A malicious user can pass a image file to the TIFFPrintDirectory function in tifprint.c, causing a null pointer dereference that can crash the application...

6.5CVSS7AI score0.02989EPSS
SaveExploits1References10Affected Software4
Veracode
Veracode
•added 2018/04/06 1:07 a.m.•41 views

Remote Code Execution (RCE)

spring-messaging is susceptible to remote code execution RCE attack. The vulnerability exists through the simple STOMP broker that exposes a weakness to malicious users who can perform a RCE attack through the STORM payload...

9.8CVSS9.5AI score0.77476EPSS
SaveExploits5References23Affected Software1
Veracode
Veracode
•added 2017/11/23 11:43 p.m.•41 views

Copy-paste Vulnerability Through LibXML2

Nokogiri and chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to the following CVEs: 1 CVE-2017-16931 - LibXML2 incorrectly handles parameter-entity references in parser.c. 2 CVE-2017-16932 - LibXML2 can enter an infinite...

9.8CVSS7.8AI score0.05928EPSS
SaveExploits0
Veracode
Veracode
•added 2017/10/13 2:06 a.m.•41 views

Denial Of Service (DoS)

ImageMagick is susceptible to denial of service DoS attacks. It is possible when an attacker inputs a malicious PSD file to the ReadPSDImage function in coders/psd.c, triggering a conditional jump or a move depending on uninitialized values...

8.8CVSS8AI score0.02725EPSS
SaveExploits0References7Affected Software1
Veracode
Veracode
•added 2017/09/08 12:51 a.m.•41 views

Denial Of Service (DoS)

FFmpeg is vulnerable to denial of service DoS attacks. A malicious user can pass a file which contains a large itemnum value to bypass the large value checking, causing the file to consume a large amount of memory that can lead to memory exhaustion in the system...

8.8CVSS8.3AI score0.02575EPSS
SaveExploits0References5Affected Software1
Veracode
Veracode
•added 2017/05/31 6:51 a.m.•41 views

Database Activity Preset Overwrites

Moodle is vulnerable to database activity presets being overwritten. Authenticated users are able to leverage a flaw when iterating arrays to overwrite database activity presets...

5.5CVSS5.9AI score0.01423EPSS
SaveExploits0References2Affected Software1
Veracode
Veracode
•added 2017/05/17 7:06 a.m.•41 views

Copy-Paste Vulnerability (CPV) Through Libxslt

nokogiri has a copied version of the libxslt library. The copy that nokogiri includes is vulnerable to the following issues: 1. CVE-2016-1683 - Denial of Service DoS via an out-of-bounds heap memory access. This is caused by libxslt mishandling namespace nodes leading to out-of-bounds heap memory...

8.1AI score0.02142EPSS
SaveExploits0
Veracode
Veracode
•added 2017/04/19 1:00 a.m.•42 views

Information Disclosure Through An External XML Entity (XXE) Vulnerability

Apache Batik is vulnerable to information disclosure through an external XML entity XXE vulnerability. The vulnerability is possible because it does not properly validate the file when handling a maliciously formed SVG file. Using this flaw, attackers can gain access to confidential information a...

7.9CVSS7.5AI score0.04118EPSS
SaveExploits0References15Affected Software2
Veracode
Veracode
•added 2017/03/24 11:29 a.m.•41 views

Cross-site Scripting (XSS)

Glassfish admingui is vulnerable to cross-site scripting XSS attacks. The library does not escape user input in the configNameSection, making it vulnerable to XSS attacks...

5.8CVSS5.5AI score0.01212EPSS
SaveExploits0References6Affected Software1
Veracode
Veracode
•added 2017/02/07 2:02 a.m.•41 views

Denial Of Service (DoS) Through Null Pointer Dereference

OpenSSL is vulnerable to denial of service DoS attacks. These attacks can be triggered in the ssl3sendclientkeyexchange function when an anonymous ECDH ciphersuite, caused a NULL certificate value...

4.3CVSS7AI score0.85784EPSS
SaveExploits0References151Affected Software1
Veracode
Veracode
•added 2017/02/06 1:54 a.m.•41 views

Information Disclosure

OpenSSL is vulnerable to padding oracle attacks. A malicious user can use an SSLv2 server as a Bleichenbacher oracle, allowing the malicious user to decrypt TLS ciphertext data...

5.9CVSS5.9AI score0.06903EPSS
SaveExploits0References30Affected Software2
Total number of security vulnerabilities5000