Denial Of Service (DoS)

dpic is vulnerable to Denial Of Service DoS. The vulnerability exists due to the buffer overflow and reads out of the bound array in the theyylex function of main.c, which allows an attacker to cause an application crash...

Denial Of Service (DoS)

dpic is vulnerable to Denial Of Service DoS. The vulnerability exists due to the heap use after free in the thedeletestringbox function of dpic.y., which allows an attacker to cause an application crash...

Denial Of Service (DoS)

dpic is vulnerable to Denial Of Service DoS. The vulnerability exists due to the heap-based buffer overflow in the thestorestring function of dpic.y., which allows an attacker to cause an application crash...

Denial Of Service (DoS)

wireshark is vulnerable to Denial Of Service DoS. The vulnerability exists due to the memory leak in the BT SDP dissector, which allows an attacker to cause an application crash via packet injection or crafted capture file...

Denial Of Service (DoS)

wireshark is vulnerable to Denial Of Service DoS. The vulnerability exists in the CBOR dissector, which allows an attacker to cause an application crash via packet injection or crafted capture file...

Denial Of Service (DoS)

wireshark is vulnerable to Denial Of Service DoS. The vulnerability exists due to the infinite loop in the BT SDP dissector, which allows an attacker to cause an application crash via packet injection or crafted capture file...

Out-Of-Bounds Memory Access

Google Chrome is vulnerable to Out-Of-Bounds Memory Access. The vulnerability exists in the Fonts, which allows an attacker to perform an out of bounds memory read via a maliciously crafted HTML page...

Use After Free

Google Chrome is vulnerable to Use After Free. The vulnerability exists in the Vulkan, which allows an attacker perform heap corruption via a maliciously crafted HTML page...

Use After Free

Google Chrome is vulnerable to Use After Free. The vulnerability exists in the Loader, which allows an attacker perform heap corruption via a maliciously crafted HTML page...

Out-Of-Bounds Memory Access

Google Chrome is vulnerable to Out-Of-Bounds Memory Access. The vulnerability exists in the CSS, which allows an attacker to perform an out of bounds memory read via a maliciously crafted HTML page...

Out-Of-Bounds Memory Access

Google Chrome is vulnerable to Out-Of-Bounds Memory Access. The vulnerability exists in the V8, which allows an attacker to perform an out of bounds memory read via a maliciously crafted HTML page...

Denial Of Service (DoS)

nasm is vulnerable to Denial Of Service DoS. The vulnerability exists due to the buffer overflow in the quoteforpmake function of nasm.c, which allows an attacker to cause an application crash via a maliciously crafted file...

Heap Buffer Overflow

binutils is vulnerable to Heap Buffer Overflow. The vulnerability exists in the findsectioninset function of readelf.c, which allows an attacker to cause an application crash by providing a maliciously crafted input...

Buffer Overflow

flac is vulnerable to Buffer Overflow. The vulnerability exists in the bitwritergrow function in the library, which allows an attacker to run arbitrary code via crafted input to the encoder...

Memory Leak

mupdf is vulnerable to Memory Leak. The vulnerability exists in the pdf-font-add.c, which allows an attacker to gain sensitive information...

Privilege Escalation

github.com/gravitl/netmaker is vulnerable to Privilege Escalation. The vulnerability exists due to improper permission validation for non-admin users, which allows an attacker to perform authorized actions on users, such as changing roles...

Open Redirect

Apache tomcat is vulnerable to Open Redirect Vulnerability. The vulnerability arises due to not validating/sanitizing the request uri used to redirect a user back to the original page after a successful form submission. The attacker can redirect a user to any malicious crafted url leading to open...

Hardcoded DNS Key

github.com/gravitl/netmaker uses a Hardcoded DNS Key. The vulnerability exists because the library does not securely set a DNS secret key, which allows an attacker to access DNS related API endpoints...

Deserialization Of Untrusted Data

org.springframework.kafka, spring-kafka is vulnerable to Deserialization Of Untrusted Data. The vulnerability is caused by not setting ErrorHandlingDeserializer when checkDeserExWhenKeyNull or checkDeserExWhenValueNull container properties are set to true. An attacker can construct a malicious...

Authorization Bypass

github.com/gravitl/netmaker is vulnerable to authorization bypass. The vulnerability exists due to an Insecure Direct Object Reference, which allows an attacker to update a password of another user...

Denial Of Service (DoS)

github.com/libp2p/go-libp2p is vulnerable to Denial-of-ServiceDoS attacks. The vulnerability allows an attacker to send a malicious signed peer record to a victim node, which can cause the victim node to run out of memory and crash...

Denial Of Service (DoS)

libgerbv.so is vulnerable to Denial of Service DoS attacks. The vulnerability is caused by an Out-of-bounds memory violation due to the way Gerber RS-274X filenames are parsed. The overflow occurs because the filename variable is not properly freed, which can cause the variable to overflow the...

Path Traversal

pyramid is vulnerable to Path Traversal. The vulnerability exists because static.py does not properly remove null-byte characters from the path element, which allows an attacker to gain access to index.html located exactly one directory above the location of the static view's file system path...

Cross-Site Scripting (XSS)

@webiny/react-rich-text-renderer is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability allows an attacker to inject malicious JavaScript code into a victim's browser, which could be used to steal cookies, session tokens, or other sensitive information due to the use of the...

Server-Side Request Forgery (SSRF)

GeoNode is vulnerable to Server-Side Request Forgery SSRF. The vulnerability allows an attacker to make unauthorized requests to arbitrary hosts on an internal network via the /proxy/?url= endpoint, which could be used to steal sensitive data, launch denial-of-service attacks, or possibly execute...

Arbitrary Code Execution

yamlbeans is vulnerable toArbitrary Code Execution. The vulnerability exists due to allowing arbitrary YAML tags by default which can represent arbitrary Java classes, which allows an attacker to execute arbitrary code if the application parses untrusted YAML files...

Denial Of Service (DoS)

yamlbeans is vulnerable to Denial Of Service DoS. The vulnerability exists due to a lack of entity expansion limits when parsing a YAML document. An attacker can exploit this flaw by creating a document small in size, but when expanded via the anchor feature expands to a large size, causing...

Remote Code Execution

vega is vulnerable to Remote code Execution RCE. The vulnerability is due to not validating/sanitizing the user supplied url used to to load an external resources web or local file system in the application. This can lead to an attacker launch RCE by pointing a user supplied URL to a malicious...

Denial Of Service (DoS)

binutils is vulnerable to Denial Of Service DoS. The vulnerability exists in the bfdmachogetsyntheticsymtab function of match-o.c, which allows an attacker to cause an aplication crash by providing a maliciously crafted input...

Denial Of Service (DoS)

binutils is vulnerable to Denial Of Service DoS. The vulnerability exists in the comparesymbols function of the library, which allows an attacker to cause an aplication crash by providing a maliciously crafted input...

Denial Of Service (DoS)

binutils is vulnerable to Denial Of Service DoS. The vulnerability exists due to the out of bound reads in the parsemodule function, which allows an attacker to cause an application crash...

Memory Leaks

binutils is vulnerable to Memory Leaks. The vulnerability occurs in parsestabstructfields within stabs.c which allows a malicious attacker to cause a denial of service locally...

Memory Leaks

binutils is vulnerable to Memory Leaks. The vulnerability occurs in prfunctiontype within prdbg.c, which allows a malicious attacker to cause a denial of service locally...

Memory Leaks

binutils is vulnerable to Memory Leaks. The vulnerability occurs in maketempdir and maketempname within bucomm.c, which allows a malicious attacker to cause a denial of service locally...

Memory Leaks

binutils is vulnerable to Memory Leaks. The vulnerability occurs in stabdemanglev3arg within stabs.c which allows a malicious attacker to cause a denial of service locally...

Reachable Assertion

binutils is vulnerable to Reachable Assertion. The vulnerability occurs due to a reachable assertion failure within the displaydebugnames function resulting in a malicious attacker to cause a denial of service...

Use After Free

Dpic is vulnerable to Use After Free. This vulnerability exists in the 'thedeletestringbox' function of 'dpic.y' due to the lack of validation of user inputs, which allows an attacker to exploit it through the use of maliciously crafted input...

Heap Buffer Overflow

dpic is vulnerable to Heap Buffer Overflow. The vulnerability exists in the themakevar function of dpic.y, which allows an attacker to cause an application crash by providing a maliciously crafted input...

Password Aging With Long Expiration

answerdev/answer is vulnerable to Password Aging With Long Expiration vulnerability. The vulnerability is due to not invalidating/expiring password reset link within a sufficient interval of time. The attacker can reset the password multiple times using the same password reset link and take over...

Improper Certificate Validation

apacheairflow is vulnerable to Improper Certificate Validation. The software does not properly validate SMTP certificates, which could allow an attacker to present a malicious certificate to the client which could be used to impersonate a legitimate mail server, allowing the attacker to steal mai...

Denial Of Service (DoS)

apacheairflow is vulnerable to Denial Of Service DoS attacks. The vulnerability can be exploited by an authenticated user with edit connection privileges, allowing them to send a large number of test connection requests, which can eventually exhaust the server's resources and cause a DoS...

Cross-site Scripting (XSS)

silverstripe/admin is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the tinymce.js due to lack of sanitization of user inputs during editing which allows an attacker to inject and execute arbitrary JavaScript into a victims browser...

Improper Access Control

waldhacker/hcaptcha library is vulnerable to Improper Access Control. This vulnerability exists because the captcha field allowed whitespaces, which allows attackers to bypass the security captcha check in the system...

Denial Of Service (DoS)

libeconf.so is vulnerable to Denial Of Service DoS. The vulnerability exists in the econfwriteFile function at libeconf.c due to a stack overflow error which allows an attacker to cause an application crash, or execute arbitrary code...

Denial Of Service (DoS)

libdjvulibre.so is Denial Of Service DoS. The vulnerability exists in the IW44Image::Map::image function at IW44Image.cpp due to a divide by zero bug resulting in a floating point exception causing an application crash...

Session Fixation

apacheairflow is vulnerable to Session Fixation. An authenticated user is able to continue to access the Airflow webserver even after their password has been reset by an admin. The vulnerability exists because the existing sessions of the user are not invalidated when the password is reset...

Locally Encrypted File Disclosure

ActiveSupport is vulnerable to Locally Encrypted File Disclosure. The vulnerability exists because the library's temporary file's permissions default to the user's current umask settings, which allows an attacker on the same system to read the contents of the temporary file before it gets encrypt...

Use After Free

mupdf is vulnerable to Use After Free. The vulnerability occurs in the svgdevtextspanaspathsdefs function within source/fitz/svg-device.c which allows a malicious attacker to parse a crafted PDF file which results in denial of service...

Cross-site Scripting (XSS)

github.com/prometheus/alertmanager is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of HTML sanitization in the generatorURL field of Alert.elm, which allows an attacker to inject and execute malicious JavaScript by sending a POST request to the /api/v1/alerts...

Insufficient Session Expiration

github.com/argoproj/argo-cd is vulnerable to Insufficient Session Expiration. The vulnerability exists because web terminal sessions in the library do not expire, which allows an attacker to send a websocket messages even if the token has already expired, leading to sensitive information...