Remote Code Execution (RCE)

RabbitMQ is vulnerable to Regular Expression Denial Of Service ReDoS. A new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper...

Denial Of Service (DoS)

Undertow AJP connector is vulnerable to denial of service. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability...

Arbitrary Code Execution

freeipa is vulnerable to Arbitrary Code Execution. An unauthenticated attacker could execute arbitrary code by trigger parsing the krb principal key via the berscanf function...

Arbitrary Code Execution

ibjpeg-turbo is vulnerable to arbitrary code execution. A remote attacker could exploit this vulnerability by send a malformed jpeg file to the service and cause arbitrary code execution or denial of service...

Denial Of Service (DoS)

rust:edge is vulnerable to denial of service. The vulnerability exists as it permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters causing an...

Remote Code Execution (RCE)

Redis is vulnerable to remote code execution. The vulnerability exists due to an integer overflow bug which can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution...

Denial Of Service (DoS)

mediawiki is vulnerable to denial of service. The system may crash when processing ApiQueryBacklinks with a full db table scan...

Remote Code Execution (RCE)

xstream is vulnerable to remote code execution. An attacker can manipulate the processed input stream and replace or inject objects, that result in execution of arbitrary code loaded from a remote server...

Remote Code Execution (RCE)

xstream is vulnerable to remote code execution. The vulnerability exists due to the usage of an insecure default blacklist which does not cover all the excluded XStream security framework...

Insecure Cryptographic Function

libapache2-mod-auth-openidc has insecure cryptographic functions. The vulnerability existis due to reusing the same key...

Request Smuggling

tomcat-coyote is vulnerable request smuggling. Incorrect way of parsing of the HTTP transfer-encoding request header causes request smuggling when it is used with a reverse proxy and if the client declared it would only accept an HTTP/1.0 response...

Denial Of Service (DoS)

ffmpeg is vulnerable to denial of service. The vulnerability exists due to a heap-based buffer overflow in libavfilter/vfyadif.c...

Denial Of Service (DoS)

linux is vulnerable to denial of service. In intelpmudrainpebsnhm in arch/x86/events/intel/ds.c in the Linux kernel on some Haswell CPUs, userspace applications such as perf-fuzzer can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6...

Information Disclosure

Elastic APM .NET Agent is vulnerable to information disclosure. Confidential HTTP header information is disclosed when logging the details during an application error...

Man-in-the-middle (MITM)

Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session...

Denial Of Service (DoS)

squid is vulnerable to denial of service. An attacker can cause a fatal error via the HTTP response of a squid cache, resulting in a denial of service condition...

Arbitrary Code Execution

exim4 is vulnerable to arbitrary code execution. A heap out-of-bounds write in parsefixphrase allows an attacker to execute arbitrary code on the host OS...

Integer Overflow

openldap:edge is vulnerable to integer overflow. An integer underflow can causes a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service...

Cross-Site Scripting (XSS)

keycloak-theme is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the referrer URL in the new account console...

Information Disclosure

chromium is vulnerable to information disclosure. The vulnerability exists through the lack of data validation in the Reader Mode that allows cross-origin data to be leaked...

Denial Of Service (DoS)

glibc is vulnerable to denial of service DoS. The vulnerability exists through sysdeps/i386/ldbl2mpn.c where a stack-based buffer overflow occurs on the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a...

Denial Of Service (DoS)

chromium is vulnerable to denial of service DoS. The vulnerability exists through a use after free flaw...

Arbitrary Code Execution

dnsmasq is vulnerable to arbitrary code execution. A heap-based buffer overflow in rfc1035.c:extractname due to the lack of length checks, which could be abused occurs when DNSSEC is enabled and before the receiving DNS entries are validated. A remote attacker who can create valid DNS replies is...

Information Disclosure

dnsmasq is vulnerable to information disclosure. The vulnerability exists because when getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to...

Insecure Permissions

ceph-ansible is vulnerable to insecure permission. The vulnerability allows any user to read sensitive information within...

Denial Of Service (DoS)

dotnet is vulnerable to denial of service DoS. The vulnerability exists through ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2...

Arbitrary Code Execution

jackson-databind is vulnerable to remote code execution RCE. The vulnerability exists through the lack of sanitization of the "org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource class through deserialization...

Arbitrary File Overwrite

github.com/thecodingmachine/gotenberg is vulnerable to directory traversal. An attacker is able to exploit the vulnerability to overwrite arbitrary files in the system and cause a denial of service condition or potentially result in arbitrary code execution...

XML External Entity (XXE)

plonesupermodel is vulnerable to XML external entity XXE attacks. The vulnerability exists due to an unapplied permission which would allow an attacker with Manager role to perform XXE attacks and submit requests on behalf of the server and access restricted internal or local resources...

Integer Overflow

open-iscsi:sid is vulnerable to integer overflow. The vulnerability exist in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packets in uipprocess in net/ipv4/uip.c...

Arbitrary Code Execution

openjpeg is vulnerable to arbitrary code execution. A heap-based buffer-overflow write allows an attacker to execute arbitrary code on the host OS...

Information Disclosure

openSSH is vulnerable to information disclosure. An attacker is able to conduct a man-in-the-middle attack to initial connections attempts due to a observable discrepancy in the algorithm negotiation...

Incorrect Preservation Of Namespace Prefixes

encoding/xml in github.com/golang/go is performing incorrect preservation of namespace prefixes. An attacker is able to provide malicious inputs to cause conflicts in the way of preserving the namespace prefixes on XML elements during tokenization round-trips...

Denial Of Service (DoS)

openldap is vulnerable to denial of service. A NULL pointer dereference during a request for renaming RDNs allows an unauthenticated remote attacker to crash the slapd process by sending a malicious request...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. An attacker is able to transmit a malicious RX descriptor to e1000ewritepackettoguest which induced an infinite loop, causing the qemu to crash resulting in denial of service...

Denial Of Service (DoS)

QEMU is vulnerable to denial of service. This vulnerability exist because of a flaw in the memory management API during the initialization of a memory region cache...

Denial Of Service (DoS)

ghostscript is vulnerable to denial of service. An attacker is able to crash the application via a malicious PDF file that results in a long running computation...

Denial Of Service (DoS)

imagemagick is vulnerable to denial of service DoS. The vulnerability exists in GammaImage of /MagickCore/enhance.c, depending on the gamma value, it's possible to trigger a divide-by-zero condition when a crafted input file is processed by ImageMagick...

Denial Of Service (DoS)

ghostscript is vulnerable to denial of service DoS. The vulnerability exists due to the heap-buffer-overflow in the lprnisblack function in contrib/lips4/gdevlprn.c, allowing an attacker to crash the application via a crafted PDF file...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. The vulnerability exists through heap buffer overflow in sdhcisdmatransfermultiblocks in hw/sd/sdhci.c which allows an attacker to cause an application crash...

Privilege Escalation

linux kernel is vulnerable to privilege escalation. A Use-after-free vulnerability in fs/blockdev.callows local users to gain additional privileges or cause a denial of service by leveraging improper access to a certain error field...

Buffer Over-read

oniguruma is vulnerable to Heap-based buffer over-read. It is possible because of a flaw in the function gb18030mbcenclen in file gb18030.c...

Remote Code Execution

ArchiveTar is vulnerable to remote code execution. An attacker is able to inject malicious code through file extension.PHARwithin a tar archive...

Content Security Bypass

firefox is vulnerable to content security policy bypass. The application does not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. It happens due to Red Hat only CVE-2020-12352 regression, allowing a remote attacker in an adjacent range to crash the system...

Arbitrary File Deletion

wordpress is vulnerable to Arbitrary File Deletion. Insecure validation of the meta key protection in isprotectedmeta in wp-includes/meta.php allows an attacker to delete arbitrary files on the host...

Arbitrary Code Execution

wordpress is vulnerable to Arbitrary Code Execution. Lack of secure validation of deserialization requests allows an attacker to submit an untrusted object to wp-includes/Requests/Utility/FilteredIterator.php which would result in unsafe deserialization, leading to arbitrary code execution...

Cross-site Scripting (XSS)

wordpress is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the addLoadEvent function in admin-header.php where an attacker is able to inject malicious script via global variables and get it executed when a user visits the page...

Denial Of Service (DoS)

linux-oem-osp1 is vulnerable to denial of service DoS. The vulnerability exists through a heap based buffer overflow in the bluetooth implementation...

Information Disclosure

OpenJDK is vulnerable to information disclosure. The vulnerability exists through a race condition in NIO Buffer boundary checks...