Sandbox Bypass

Apache Syncope is vulnerable to a Sandbox bypass. The vulnerability is due to improper isolation of the Groovy security sandbox, where an administrator with sufficient entitlements can create a malicious Groovy class containing untrusted code, and attackers can bypass the sandbox to execute...

Arbitrary Symlink Creation

decompress is vulnerable to arbitrary symlink creation. The vulnerability is due to insufficient validation of symlink targets during archive extraction, which allows an attacker to craft a malicious archive containing symlink entries that point to sensitive files outside the extraction directory...

Improper Authentication

Apache Hive is vulnerable to improper authentication. The vulnerability is due to improper validation of SAML bearer tokens, which allows an unauthenticated network attacker to forge an Authorization: Bearer token and authenticate as an arbitrary Hive user, thereby obtaining an authenticated...

Server-Side Request Forgery (SSRF)

Apache Hive is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of the avro.schema.url table property, which allows an authenticated remote attacker with CREATE TABLE privileges to configure an attacker-controlled URL and cause the Hive server to make...

Authorization Bypass

Apache ActiveMQ is vulnerable to Authorization Bypass. The vulnerability is due to the authorization check being bypassed for temporary composite destinations, where an authenticated low‑privilege user can send messages to a temporary composite destination whose physical name is a comma‑separated...

Denial Of Service

Apache ActiveMQ is vulnerable to Denial of Service. The vulnerability is due to improper input validation of the frame size value in the AMQP NIO connector, where an attacker can send a crafted frame size that causes the NIO threads to die and, if performed rapidly, exhaust the NIO thread pool,...

URL Path Injection

Apache Gravitino is vulnerable to URL Path Injection. The vulnerability is due to unencoded user-supplied identifiers being used in URL paths, allowing an attacker to inject path components into requests...

Path Traversal

art-template is vulnerable to Path Traversal. The vulnerability is due to the template sub-template resolution logic using path.resolveroot, filename without validating that the resolved path remains within the intended root directory, which allows an attacker to use path traversal sequences to...

Improper Certificate Validation

Bouncy Castle for Java is vulnerable to Improper Certificate Validation. The vulnerability is due to improper hostname verification behavior, which allows an attacker to exploit certificate validation by relying on the certificate’s Common Name CN when the hostname does not properly match the...

Improper Verification Of Cryptographic Signature

Bouncy Castle for Java is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to RSA PKCS1 signature verification skipping the last two hash bytes when processing the NULL-omitted path, which allows an attacker to forge or bypass RSA signature verification by...

Denial-of-Service (DoS)

Protego is vulnerable to a Denial-of-Service DoS. The vulnerability is due to excessive backtracking caused by translating multiple asterisks in Allow or Disallow directives into lazy regular-expression wildcards, which allows an attacker to provide a crafted robots.txt file and cause...

SQL Injection

WsgiDAV is vulnerable to SQL Injection. The vulnerability is due to the MySQLBrowserProvider directly concatenating a record key from the request URL into SQL WHERE clauses, which allows an attacker with access to a share configured with this non-default provider to inject malicious SQL through a...

Header Injection

Apache Camel Knative component is vulnerable to Header Injection. The vulnerability is due to structured CloudEvent extension fields being copied into Exchange headers without filtering, allowing an attacker to inject Camel-internal headers and influence downstream components, potentially enablin...

Remote Code Execution (RCE)

Spinnaker is vulnerable to remote code execution RCE. The vulnerability is due to unsafe processing of YAML tags during Kustomize bake operations, which allows an attacker to execute arbitrary code remotely on Rosco pods when a Kustomize bake operation is performed...

WebSocket Header Injection

Apache Camel Atmosphere Websocket component is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered websocket.connectionKey and websocket.connectionKey.list headers controlling WebSocket message dispatch, allowing an external sender to suppress or redirect messages to a...

OS Command Injection

com.powsybl, powsybl-computation-local is vulnerable to OS command injection. The vulnerability is due to insufficient escaping of attacker-controlled command arguments and environment variables before they are passed to shell interpreters, which allows an attacker to inject and execute arbitrary...

Improper Input Validation

Graylog is vulnerable to Improper Input Validation. The vulnerability is due to improper parsing of field-like text and escaped quotes within quoted FortiGate syslog values, which allows an unauthenticated network attacker to manipulate or overwrite security-log fields or cause messages to be...

Improper Certificate Validation

org.mariadb.jdbc:mariadb-java-client is vulnerable to Improper Certificate Validation. The vulnerability is due to improper certificate fingerprint validation during the initial TLS handshake, which allows an active man-in-the-middle attacker or malicious server to present a self-signed certifica...

Path Traversal

Apache Camel Azure-Storage Datalake component is vulnerable to Path Traversal. The vulnerability is due to DataLakeFileOperations.downloadToFile joining the configured fileDir with an unvalidated remote path name, allowing an attacker to influence Data Lake file names and cause files to be create...

XML External Entity (XXE) Injection

mapfish-print is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper parsing of attacker-controlled XML with external entities and DTDs enabled, which allows an unauthenticated attacker to read local files and perform server-side request forgery SSRF by accessing...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

Improper Input Validation

github.com/free5gc/free5gc is vulnerable to improper input validation. The vulnerability is due to insufficient validation of NF Profile data, which allows an attacker with SBI access to submit malicious profiles containing attacker-controlled network-function endpoints, causing them to be...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to delegated administrators being able to retrieve invitation registration links for non-existent email addresses, allowing them to create unauthorized user accounts and add them to an organization without the required use...

Nesting-Depth Guard Bypass

Bouncy Castle for Java is vulnerable to a nesting-depth guard bypass. The vulnerability is due to forcing a lazy ASN.1 sequence resetting the nesting-depth guard, which allows an attacker to exploit deeply nested ASN.1 structures...

Plaintext Exposure

Bouncy Castle for Java is vulnerable to plaintext exposure. The vulnerability is due to CCM-family modes writing decrypted plaintext to the caller-provided buffer before verifying the authentication tag, which allows an attacker to exploit unauthenticated or tampered ciphertext to access plaintex...

Uncontrolled Resource Consumption

Bouncy Castle is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to quadratic-time processing when escaping X.500 distinguished names during stringification, which allows an attacker to supply specially crafted input that causes excessive CPU consumption and potentially...

Uncontrolled Resource Consumption

Bouncy Castle is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded upfront memory allocation when processing attacker-controlled definite-length data, which allows an attacker to trigger excessive memory consumption and potentially cause an Out-of-Memory...

Uncontrolled Resource Consumption

Bouncy Castle is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to insufficient bounds on PKCS12 MAC and bag-decryption KDF iteration counts, which allows an attacker to supply excessive iteration values and cause high computational resource consumption, resulting in...

Uncontrolled Resource Consumption

Bouncy Castle for Java is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the BCFKS keystore loading an attacker-controlled and unbounded KDF cost from an untrusted keystore file, which allows an attacker to trigger excessive computational resource consumption and cau...

Improper Cryptographic Verification

Bouncy Castle is vulnerable to Improper Cryptographic Verification. The vulnerability is due to the KCCMBlockCipher MAC not binding the nonce when no Additional Authenticated Data AAD is present, which allows an attacker to forge authenticated ciphertexts across different nonces...

Denial Of Service (DoS)

Bouncy Castle is vulnerable to Denial Of Service DoS. The vulnerability is due to an unbounded HSS public-key level count during verification, which allows an attacker to trigger excessive memory allocation and potentially cause a denial-of-service condition...

MAC Forgery Vulnerability

Bouncy Castle for Java is vulnerable to a MAC forgery vulnerability. The vulnerability is due to improper handling of the KDF key split based on message length, which allows an attacker to forge the MAC and potentially modify or authenticate manipulated ciphertext without detection...

OCSP Response Validation Bypass

Bouncy Castle for Java is vulnerable to an OCSP response validation bypass. The vulnerability is due to the failure to properly associate the stapled OCSP response with the intended certificate, which allows an attacker to exploit the validation process by providing a valid OCSP response for a...

Improper Tag-Length Validation

Bouncy Castle for Java is vulnerable to improper tag-length validation. The vulnerability is due to the failure to enforce the required authentication tag length during decryption, which allows an attacker to provide a malformed or truncated authentication tag and potentially bypass the intended...

Arbitrary File Write

browse-mcp is vulnerable to Arbitrary File Write. The vulnerability is due to improper validation of caller-controlled file paths and save directories, which allows an attacker to write malicious content to arbitrary files accessible by the process and potentially execute code on the host...

Denial-of-Service (DoS)

Bouncy Castle for Java FIPS BC-FJA is vulnerable to a Denial-of-Service DoS. the vulnerability is due to the JNI seeding routine repeatedly retrying the RDSEED/RDRAND CPU instructions without a limit when entropy generation fails, which allows an attacker or environmental condition causing...

Path Traversal

Whistle is vulnerable to Path Traversal. The vulnerability is due to improper validation of the user-supplied filename parameter, which allows a remote attacker to access and read arbitrary files from the server, such as /etc/passwd...

Improper Verification Of Cryptographic Signature

Bouncy Castle is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to OpenPGP AEAD decryption failing to verify the final authentication tag for chunk-aligned data, which allows an attacker to modify encrypted data without detection and potentially bypass...

Uncontrolled Resource Consumption

Bouncy Castle is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to allocating memory based on an attacker-controlled opaque length before performing bounds validation, which allows an attacker to trigger excessive memory allocation and potentially cause a...

Missing Release Of Resource After Effective Lifetime

Bouncy Castle is vulnerable to Missing Release of Resource after Effective Lifetime. The vulnerability is due to reliance on Java object finalization to zeroise sensitive key material, which can cause pending finalization queues to grow under load, leading to memory exhaustion and prolonged...

Denial Of Service (DoS)

Phoenix is vulnerable to Denial-of-Service DoS. The vulnerability is due to an unsafe truthiness check for attacker-controlled presence keys that can reference JavaScript Object.prototype properties, which allows an attacker to trigger uncaught exceptions and cause persistent client-side denial o...

Path Traversal

Nx is vulnerable to Path Traversal. The vulnerability is due to improper validation of paths when extracting cache artifacts from a self-hosted remote cache, which allows a malicious or on-path cache server to provide a crafted archive that writes files outside the cache directory and potentially...

SQL Injection

ureport is vulnerable to SQL Injection. The vulnerability is due to insufficient validation of SQL statements in the /ureport/datasource/previewData component, which allows an attacker to inject crafted SQL queries and access sensitive database information...

Sensitive Information Disclosure

Keycloak is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper masking of sensitive authentication configuration values, which allows administrators with view-only permissions to access third-party service credentials such as reCAPTCHA secret keys...

Denial-of-service (DoS)

io.netty.incubator, netty-incubator-codec-ohttp is vulnerable to a denial-of-service DoS. The vulnerability is due to an allocated direct ByteBuf not being released when AEAD tag verification fails, which allows an attacker to repeatedly send invalid encrypted requests and exhaust native memory,...

URI Validation Bypass

http4k-security-digest is vulnerable to URI Validation Bypass. The vulnerability is due to the client not validating the uri parameter in the Digest authentication response against the actual request URL, which allows an attacker to replay a captured authentication response against other URLs...

SQL Injection

org.geotools.jdbc, gt-jdbc-postgis is vulnerable to SQL injection. The vulnerability is due to the jsonArrayContains function failing to escape user-supplied values in generated SQL queries, which allows an attacker to inject malicious SQL through OGC filters when using the PostGIS DataStore with...

Denial Of Service

netty-incubator-codec-ohttp is vulnerable to Denial of Service. The vulnerability is due to the BinaryHttpParser not enforcing limits for encoded variable length fields, where a remote peer controls these lengths and can cause the parser to buffer data indefinitely...

OS Command Injection

React create-react-app is vulnerable to OS command injection. The vulnerability is due to improper handling of input in the startBrowserProcess function of openBrowser.js in react-dev-utils, which allows an attacker to manipulate the input and execute arbitrary operating system commands remotely...