Resource Exhaustion

Apache Qpid Broker-J is vulnerable to resource exhaustion. The vulnerability is due to the inability to govern the maximum number of transfer frames per incoming delivery, where an authenticated attacker can cause excessive resource usage and potential denial of service...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper enforcement of the session flow control incoming window, which allows an authenticated attacker to exceed the permitted window and cause resource exhaustion, potentially resulting in a...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to inefficient handling of large or invalid ranges in disposition frames, which allows an authenticated attacker to cause excessive CPU consumption and trigger a denial-of-service condition...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to the fetch adapter passing the original fetchOptions to fetch instead of the sanitized resolvedOptions, where inherited Object.prototype.headers overrides the request headers, and an attacker who can pollute the prototype can...

Redirect Bypass

axios is vulnerable to redirect bypass. The vulnerability is due to the fetch adapter not honoring the maxRedirects option, where it constructs the fetch request without a redirect field—so the Fetch API defaults to redirect: 'follow'—and attackers can supply a redirecting URL to cause the reques...

Improper Input Validation

Astro is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of malformed port values in the HTTP Host header when constructing request URLs, which allows an attacker to trigger an uncaught TypeError that can cause the Node.js process to terminate and result in ...

Regular Expression Denial Of Service

Axios is vulnerable to a Regular Expression Denial Of Service. The vulnerability is due to quadratic backtracking in the regular expression used by shouldBypassProxy, where the pattern hostname.replace/\.+$/, '' scans a hostname composed of many dots followed by a non‑dot character, and an...

Resource Allocation

com.github.java-json-tools, jackson-coreutils is vulnerable to resource allocation. The vulnerability is due to improper resource allocation in the TreePointer.tokensFromInput function of the JSON Pointer parser, which allows a remote attacker to exploit the parser and cause excessive resource...

Uncontrolled Recursion

org.apache.neethi, neethi is vulnerable to uncontrolled recursion. The vulnerability is due to uncontrolled recursive policy parsing, which allows an attacker to provide a maliciously crafted deeply nested or ID-less policy that causes excessive runtime memory consumption and potentially crashes...

Denial-Of-Service (DoS)

Apache Qpid Proton-J is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation and potentially cause a denial of service...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to the Node HTTP adapter not setting its own createConnection property, where the adapter supplies request options without an own createConnection value and Node resolves and invokes an inherited Object.prototype.createConnectio...

Unauthenticated Arbitrary File Disclosure

org.apache.wicket, wicket-core is vulnerable to an unauthenticated arbitrary file disclosure. The vulnerability is due to improper validation of attacker-controlled locale, style, and variation URL attributes before they are appended to the resource path, which allows an attacker to use path...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Object.prototype.headers during request configuration normalization, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled HTTP headers, including...

Rate Limiting Bypass

Apache Qpid Broker-J is vulnerable to Rate Limiting Bypass. The vulnerability is due to the broker's inability to govern the rate at which it responds to an echo flow, where the response handling lacks proper throttling and an authenticated attacker can trigger excessive resource usage leading to...

Path Traversal

Apache Ivy is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of module coordinates in the PackagerResolver, where the calculated subdirectory path based on coordinates such as organisation, name, or version is concatenated with the buildRoot directory and an...

Denial Of Service

Apache Neethi is vulnerable to Denial of Service. The vulnerability is due to remote policy references being manually retrieved via the API without size limits, where the library reads data from remote policy references without imposing a maximum size and an attacker can supply a huge policy...

Uncontrolled Resource Consumption

multiparty is vulnerable to Uncontrolled Resource Consumption.The vulnerability is due to unrestricted memory usage while accumulating multipart part headers, which allows an unauthenticated attacker to send a request with excessively large headers and exhaust process memory, causing the server t...

Cross-Site Scripting (XSS)

org.apache.wicket, wicket-extensions is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to AjaxEditableChoiceLabel and related components writing attacker-influenced renderer or overridden defaultNullLabel values directly into the page markup without HTML escaping, which allows a...

Cross-Site Scripting (XSS)

serialize-javascript is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of attacker-influenced function source when serialized for embedding in a...

Denial Of Service (DoS)

@angular/router is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient handling of numeric matrix parameter and outlet names that causes excessive memory allocation for JavaScript objects, which allows a remote attacker to craft malicious URLs that trigger significant...

Regular Expression Denial Of Service

Axios is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to excessive regular-expression backtracking in DATAURLPATTERN when fromDataURI processes malformed data: URLs with many slash characters and no comma, allowing an attacker to block the Node.js event loop...

Prototype Pollution

axios is vulnerable to prototype‑pollution. The vulnerability is due to the default‑instance request code reading an inherited method value from Object.prototype, where the line config.method = config.method || this.defaults.method || 'get'.toLowerCase; falls back to this.defaults.method that can...

Improper Neutralization Of Input During Web Page Generation

org.apache.wicket, wicket-core is vulnerable to improper neutralization of input during web page generation. The vulnerability is due to the resolver rendering attacker-influenced label values without escaping, which allows an attacker to inject malicious markup or script content into a web page...

Denial Of Service

Axios is vulnerable to Denial Of Service. The vulnerability is due to Http2Sessions lacking adequate error handling for ClientHttp2Session errors during HTTP/2 session initialization or reuse, allowing an uncaught error to terminate the Node.js process...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Symbol.toStringTag, append, and getHeaders properties during FormData header resolution, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled...

Proxy Exclusion Bypass

Axios is vulnerable to Proxy Exclusion Bypass. The vulnerability is due to CIDR-form NOPROXY entries not being interpreted as IP ranges, allowing requests to internal IP addresses to bypass the intended proxy exclusion and be routed through the configured proxy...

Server-Side Request Forgery (SSRF)

Astro is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improperly anchored regular expressions used to validate Netlify Image CDN remote-image URLs, which allows an unauthenticated attacker to bypass host allowlists and cause the Image CDN to request...

Proxy And DNS Bypass

axios is vulnerable to Proxy and DNS bypass. The vulnerability is due to the HTTP/2 adapter not applying the caller‑supplied lookup function and proxy configuration, where the adapter builds the session with http2.connectauthority, http2Options using only the http2Options object and therefore omi...

Uncontrolled Resource Consumption

t-digest is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper validation of centroid means during deserialization in MergingDigest.fromBytes, which allows an attacker to inject NaN values that bypass validation checks and degrade sorting performance from On log...

Improper Certificate Validation

Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...

Uncontrolled Resource Consumption

Apache Neethi is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to insufficient enforcement of the maximum number of normalized policy alternatives, which allows an attacker to submit crafted policies that bypass the limit and consume excessive resources, causing a...

Uncontrolled Resource Consumption

Apache Qpid Proton-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper handling of deeply nested types, which allows a pre-authentication attacker to trigger a StackOverflowError and cause a denial-of-service condition...

Cross-site Scripting (XSS)

Apache Wicket is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of attacker-influenced model data rendered inside elements, which allows an attacker to inject and execute malicious HTML or script content in a victim's browser...

Internationalized Domain Name Validation

Nodemailer is vulnerable to an internationalized domain name validation/bypass. The vulnerability is due to inconsistent Punycode A-label generation, which allows an attacker to craft recipient addresses containing invisible characters or compatibility mappings to bypass domain allow-list checks...

Denial Of Service

Apache Qpid Proton-J is vulnerable to denial of service. The vulnerability is due to unbounded symbol value caching, where the cache can grow without limit and a pre-authentication attacker can send crafted data to exhaust resources, leading to denial of service...

Denial Of Service

Apache Qpid Proton-J is vulnerable to Denial of Service. The vulnerability is due to insufficient validation of the session flow control incoming window, where an authenticated attacker can exceed the incoming window size and potentially cause denial of service...

Prototype Pollution

joi is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of proto keys during message compilation, which allows an attacker to manipulate the returned object's prototype and disrupt downstream code that relies on Object.prototype methods...

Improper Resource Management.

compression is vulnerable to Improper Resource Management. The vulnerability is due to the zlib compression stream not being destroyed after a client disconnects, which allows a remote unauthenticated attacker to repeatedly initiate requests and terminate connections early, exhausting server memo...

Denial Of Service

Apache Qpid Proton-J is vulnerable to Denial of Service. The vulnerability is due to naive range handling, where an authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage and leading to denial of service...

Resource Exhaustion

Apache Qpid Proton-J is vulnerable to resource exhaustion. The vulnerability is due to the inability to govern the maximum number of transfer frames per incoming delivery, where the library does not enforce a limit on the number of frames and an authenticated attacker can send deliveries with...

Alternate Path Bypass

Apache Tika is vulnerable to an alternate path bypass. The vulnerability is due to improper protection of an alternate path, where the library does not properly validate alternate file paths and attackers can supply crafted paths to access unauthorized resources...

Improper Validation Of Nested Digest Algorithm Sequence Elements

node-forge is vulnerable to improper validation of nested DigestAlgorithm sequence elements. The vulnerability is due to insufficient validation of element counts in the DigestAlgorithm sequence, which allows an attacker to insert garbage bytes and forge valid signatures for arbitrary messages wh...

Uncontrolled Resource Consumption

zstd-jni is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper validation of negative length parameters in ZstdInputStreamNoFinalizer.read, which allows an attacker to trigger an infinite loop that holds the stream monitor and blocks other threads from accessing...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper validation of negative srcPosition arguments in Zstd.getFrameContentSize, which allows an attacker to bypass bounds checks and trigger out-of-bounds memory reads, potentially causing information disclosure or JVM...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of JSON request bodies into memory despite the configurable input length limit, which allows an attacker to submit an oversized JSON request and exhaust the application's heap, causi...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of Content Security Policy violation reports into memory, which allows an unauthenticated attacker to submit an oversized report and exhaust the application's heap, causing a...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded growth of internal localized-text caches based on attacker-controlled locale values from incoming requests, which allows an unauthenticated remote attacker to exhaust the Java heap and cause a...

Improper Signature Verification

Bouncy Castle for Java is vulnerable to Improper Signature Verification. The vulnerability is due to CMS.verifySignatures returning true for SignedData objects containing no signers, which allows an attacker to bypass signature verification and have unsigned data incorrectly treated as successful...

Uncontrolled Resource Consumption

Bouncy Castle for Java is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded iteration counts in CRMF/CMP password-MAC processing, which allows an attacker to supply a maliciously high iteration count and cause excessive resource consumption, potentially...

Improper Certificate Validation

Netty is vulnerable to Improper Certificate Validation. The vulnerability is due to disabled TLS hostname verification in the SslProvider.OPENSSL client path under specific configurations, which allows a man-in-the-middle attacker to present a certificate issued for a different hostname and...