Information Disclosure

OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug during the montgomery squaring procedure. This makes it easier for a malicious user to obtain sensitive private key information from the Diffie-Hellman Ciphersuite as the attack can be conducted offline...

Security Constraint Bypass

Spring security web is vulnerable to security constraint bypass. It does not consider URL path parameters when processing security constraints. By adding an URL path parameter with an encoded / to a request, an attacker is able to bypass a security constraint. The root cause of this issue is a la...

Improper Input Validation

github.com/ollama/ollama is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of the digest format sha256 with 64 hex digits when getting the model path, which results in the mishandling of the TestGetBlobsPath test cases with fewer than 64 hex digits, more...

Cross-Site Scripting (XSS)

froxlor/froxlor is vulnerable to Cross-Site Scripting. The vulnerability is due to inadequate sanitization of user input in the loginname parameter during failed login attempts, which allows attackers to inject and store malicious scripts that are executed when an administrator views the System...

Resource Exhaustion

go-ethereum geth is vulnerable to a Resource Exhaustion. The vulnerability is due to a lack of proper handling of specially crafted p2p messages sent from an attacker node, causing vulnerable nodes to consume excessive amounts of memory...

Denial Of Service (DoS)

Bouncy Castle is vulnerable to an infinite loop. The vulnerability is due to insufficient verification of signatures and public keys during Ed25519 verification, allowing attackers to trigger a denial of service DoS due to the infinite loop...

Authorization Bypass

keycloak is vulnerable to Authorization Bypass. The vulnerability is due to a hardcoded permissive regular expression which is used to filtering allowed hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with specific...

Code Injection

Apache Zeppelin is vulnerable to a Code Injection. The vulnerability is due to improper verification of the JDBC driver configuration which allows an attacker to inject malicious code when connecting MySQL database...

Denial Of Service (DoS)

github.com/nghttp2/nghttp2/ is vulnerable to Denial of Service DoS. The vulnerability is due a lack of frame count restrictions, which can result in nghttp2 reading an unbounded number of HTTP/2 CONTINUATION frames even after the stream is reset to keep HPACK context in sync. An attacker can...

Sensitive Information Disclosure

libmbedtls.so is vulnerable to Sensitive Information Disclosure. The vulnerability is due to inadequate handling of shared memory within the PSA Crypto API, potentially leading to information disclosure...

Session Fixation

@workos-inc/authkit-nextjs vulnerable to Session Fixation. This vulnerability is due to the improper handling of expired sessions within session.ts. This allowing an attacker to reuse an expired session by controlling the x-workos-session header...

Cross-Site Request Forgery (CSRF)

Apache Wicket is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is caused due to an error in the evaluation of the fetch metadata headers within FetchMetadataResourceIsolationPolicy.java. This allows an attacker to bypass the Cross-Site Request Forgery CSRF protection mechanism...

Credential Leakage

follow-redirects is vulnerable to Credential Leakage. The vulnerability is due to insufficient redaction of the proxy-authentication header when handing requests. If an attacker can trigger a cross domain redirect, they can capture the request header containing the sensitive proxy-auth header,...

Improper Authentication

wpasupplicant is vulnerable to the Improper Authentication vulnerability. The vulnerability arises because wpasupplicant can be configured to skip TLS certificate verification during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be exploited to bypass Phase 2 authentication...

Denial Of Service (DoS)

Microsoft QUIC is vulnerable to Denial Of Service DoS. The vulnerability is caused by holding onto failed connections, leading to continuous memory consumption until exhaustion, resulting in Denial of Service. Note that this vulnerability is not exploitable on .NET-based web servers running on...

Off-by-one Error

libvirt.so is vulnerable to Off-by-one Error. The vulnerability is due to a miscalculation in the udevListInterfacesByStatus function when the number of interfaces exceeds the size of the names array. This issue can be exploited by sending specially crafted data to the libvirt daemon, enabling an...

Server Side Request Forgery (SSRF)

mpdf/mpdf is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to not sanitizing user input while creating PDF when using html2pdf service. An attacker can exploit this flaw to use crafted html to include any arbitrary URL in the input to read the data from or to attack the...

Regular Expression Denial Of Service (ReDoS)

rack is vulnerable to a Denial Of Service. This vulnerability is due the handling of content type parsing which utilizes a regex pattern with inefficient complexity, which allows attackers to launch DoS attacks...

Cross-site Websocket Hijacking (CSWSH)

meshcentral is vulnerable to Cross-site Websocket HijackingCSWSH. The vulnerability is due to missing origin checks when using the control.ashx endpoint in MeshCentral. If an attacker can convince an admin end-user to click on a malicious link, they then can access the control.ashx admin panel...

Insecure Deserialisation

clearml is vulnerable to Insecure Deserialisation. The vulnerability is due to Deserialisation of untrusted data. An attacker can upload a malicious pickle file via the project API to run arbitrary code on an end user's system...

Information Leak

Google Chrome is vulnerable to Information Leak. The vulnerability is caused due to Inappropriate implementation in Extensions API that causes an attacker to convince a user to install a malicious extension. This can be exploited to leak cross-origin data via a crafted Chrome Extension...

Denial Of Service (DOS)

openssl is vulnerable to Denial Of Service DOS. The vulnerability is caused due to excessive time spent while checking invalid RSA public keys. This eventually results in Denial Of Service DOS...

Heap Buffer Overflow

libxml2 is vulnerable to Heap Buffer Overflow. The vulnerability is due to improper bound checking. This issue can be exploited by an attacker via parsing a malicious file to execute arbitrary code within the context of an unprivileged process...

Remote Code Execution (RCE)

org.apache.struts: struts2-core is vulnerable to Remote Code Execution. The vulnerability is due to the HttpParameters class in HttpParameters.java failing to sanitize parameters with different cases. The remove , get and contains methods treat parameters with different character cases as unique...

Buffer Overflow

libespeak-ng.so is vulnerable to Buffer Overflow. The vulnerability is caused by the ReadClause function in readclause.c due to not having a bounds check when writing data to buffer. This allows an attacker to craft an input to trigger the overflow, potentially leads to code execution or Denial o...

Use After Free

chromium is vulnerable to Use after free.The vulnerability is due to there is no proper memory management in Media Capture feature in Google Chrome. An attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction...

Use After Free

Chromium is vulnerable to Use After Free. The vulnerability is due to improper memory management in Side Panel Search in Google Chrome. This allows an attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction...

Use After Free

Google Chrome is vulnerable to Use After Free. The vulnerability exists in libavif, potentially enabling an attacker to exploit heap corruption through a maliciously crafted AVIF file...

Code Injection

dotnet is vulnerable to Code Injection. The vulnerability is due to lack of adequate validation for untrusted URIs provided to System.Net.WebRequest.Create. This allows an attacker can provide a specially crafted URI to the WebRequest.Create method, that could potentially execute arbitrary comman...

Policy Bypass

nodejs is vulnerable to Policy Bypass. The vulnerability allows a malicious attacker to intercepting the resource integrity check performed by the Node.js policy feature and to get a forged checksum resulting in potential malicious code execution...

Privilege Escalation

intel-microcode is vulnerable to Privilege Escalation. The vulnerability exists due to a sequence of processor instructions that results in unexpected behavior for certain IntelR Processors. An authenticated user may exploit this issue to potentially enable escalation of privilege, information...

Arbitrary Code Execution

The PostgreSQL is vulnerable to Arbitrary Code Execution. The vulnerability is caused due to missing overflow checks during SQL array value modification. This can lead to an authenticated database user write arbitrary bytes to memory and extensively read the server's memory by exploiting an integ...

Denial Of Service (DOS)

PostgreSQL is vulnerable to Denial Of Service DOS. The vulnerability is caused due to a flaw involving pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. This can lead to a remote high privileged user ...

Denial Of Service (DoS)

ASP.NET Core is vulnerable to Denial of Service DoS. The vulnerability occurs when an attacker cancels a HTTP requests made to ASP.NET Core running on an IIS In Process hosting model, which may cause an increase in thread counts, potentially leading to an OutOfMemoryException, which results in...

Path Traversal

galaxyimporter is vulnerable to Path Traversal. The vulnerability is due to incorrect symbolic link handing, allowing an attacker to construct a specially crafted tarball that,when imported using the galaxy importer of Ansible Automation Hub, creates a symbolic link on the disk, potentially...

HTTP Request Smuggling

aiohttp is vulnerable to HTTP Request Smuggling. The vulnerability exists due to an inconsistent interpretation of the Content-Length CL and Transfer-Encoding TE headers in httpparser.py, which can be exploited to bypass proxy rules, poison sockets, and potentially redirect users to malicious...

Remote Code Execution (RCE)

chromium is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the incorrect security UI in Downloads, which allows a remote malicious attacker to obfuscate security UI via a crafted HTML page...

Buffer Overflow

libz.so is vulnerable to Buffer Overflow. The vulnerability is present due to the absence of length checks in the filename, extrafield, and comment parameters within the zip.c. This oversight enables an attacker to trigger an integer overflow, leading to a heap-based buffer overflow in the...

Denial Of Service (DoS)

libpoppler.so is vulnerable to Denial of Service DoS. An infinite recursion in the Catalog::findDestInTree function allows an attacker to exploit this vulnerability by crafting a malicious PDF file that will cause the library to crash...

Denial Of Service (DoS)

python2.7 is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the library, allowing an attacker to cause an application crash through the heappushpop in heapq...

Heap Buffer Overflow

binutils is vulnerable to Heap Buffer Overflow. The vulnerability exists in the findsectioninset function of readelf.c, which allows an attacker to cause an application crash by providing a maliciously crafted input...

Denial Of Service (DoS)

binutils is vulnerable to Denial Of Service DoS. The vulnerability exists in the bfdmachogetsyntheticsymtab function of match-o.c, which allows an attacker to cause an aplication crash by providing a maliciously crafted input...

HTTP Request Smuggling

Haproxy is vulnerable to HTTP Request Smuggling. This vulnerability exists in the HTTP/1 server, which interprets a payload as an extra request due to empty Content-Length headers being forwarded. This allows an attacker to inject malicious payloads into the system...

Buffer Overflow

ghostscript is vulnerable to Buffer Overflow. The vulnerability exists in the devnpcxwriterle function of gdevdevn.c, which allows a local malicious attacker to cause a denial of service via a crafted PDF file for a DEVN device with gs...

Denial Of Service (DoS)

libpoppler.so is vulnerable to Denial Of Service DoS. The vulnerability exists due to the heap buffer overflow in the FoFiType1C::cvtGlyph function of fofi/FoFiType1C.cc, allowing an attacker to cause an application crash...

Denial Of Service (DoS)

w3m is vulnerable to Denial of Service DoS attacks. This vulnerability occurs when w3m parses a specially crafted HTML file that contains an out-of-bounds read. If the file is valid, w3m could crash...

Information Disclosure

gitlab is vulnerable to Information Disclosure. A malicious authenticated maintainer is able to leak the sentry token by changing the configured URL in the sentry error tracking settings page...

Use After Free

chromium is vulnerable to Use After Free. The vulnerability exists in the Base Internals of the library, allowing an attacker to perform arbitrary read/write via a maliciously crafted HTML page...

Remote Code Execution (RCE)

redis is vulnerable to Remote Code Execution RCE. This vulnerability occurs due to a flaw in the way that Redis handles key names. An attacker can exploit this vulnerability to cause Redis to crash or to execute arbitrary code...

Privilege Escalation

gitlab is vulnerable to Privilege Escalation. This vulnerability occurs due to a flaw in the way that GitLab handles project tokens. An attacker with the "Maintainer" role on any project can exploit this vulnerability to gain the "Internal" role on the same project, which grants them elevated...