Summary
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
Product
Dell ECS ist ein Objektspeichersystem.
Vulnerabilities 500
-
High 7.5
HTTP/2 Stream Cancellation Attack
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
KEV Oct 10, 2023 -
Critical 9.8
Authentication Bypass in github.com/russellhaering/gosaml2
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of proces…
-
Critical 9.8
The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes d…
-
Critical 9.8
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
-
Critical 9.8
Java deserialization in Chainsaw
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
-
Critical 9.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
-
Critical 9.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
-
Critical 9.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
-
Critical 9.8
SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" paramet…
-
Critical 9.8
Heap buffer overflow in libhdfs native library
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 o…
-
Critical 9.8
Keycloak vulnerable to privilege escalation on Token Exchange feature
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a…
-
Critical 9.8
The c_rehash script allows command injection
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…
-
Critical 9.8CVE-2022-2068 EPSS 96%
The c_rehash script allows command injection
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…
-
Critical 9.8
Authorization bypass in Spring Security
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression …
-
Critical 9.8
SQL injection in JDBC Appender in Apache Log4j V1
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate…
-
Critical 9.8CVE-2022-23521 EPSS 56%
gitattributes parsing integer overflow in git
Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes tha…
-
Critical 9.8
Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run …
-
Critical 9.8
Arbitrary file write in FileUtil#unpackEntries on Windows
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A su…
-
Critical 9.8
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data …
-
Critical 9.8
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability ca…
-
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
-
Critical 9.8
Integer overflow in `git archive`, `git log --format` leading to RCE in git
Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, t…
-
Critical 9.8
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…
-
Critical 9.8
Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
-
Critical 9.8
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,…
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…
-
Critical 9.8
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an att…
-
Critical 9.8
Code injection via go command with cgo in cmd/go
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in th…
-
Critical 9.1
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
-
Critical 9.1
Hazelcast connection caching
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9…
-
Critical 9.1
Apache Ivy allows creating/overwriting any file on the system
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the targ…
-
Critical 9.1CVE-2023-34034 Public exploit
Access Control Bypass in Spring Security
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
-
Critical 9.0
Apache HTTP Server: mod_proxy_ajp Possible request smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
-
High 8.8CVE-2020-10673 Public exploit
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
-
High 8.8CVE-2020-11113 Public exploit
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
-
High 8.8
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
-
High 8.8CVE-2020-36180 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
-
High 8.8
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.
-
High 8.8
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
-
High 8.8CVE-2020-36184 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
-
High 8.8CVE-2021-25642 Public exploit
Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler
ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users sho…
-
High 8.8CVE-2021-30560 EPSS 20%
Nokogiri has vulnerable dependencies on libxml2 and libxslt
Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
-
High 8.8
Apache Hadoop Privilege escalation vulnerability
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
-
High 8.8
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ch…
-
High 8.8CVE-2022-23302 EPSS 64%
Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Top…
-
High 8.8CVE-2022-23307 EPSS 54%
A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
-
High 8.8
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to …
-
High 8.8
In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edg…
-
High 8.8
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly r…
-
High 8.8CVE-2023-32697 Public exploit
Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled
SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.
-
High 8.6
runc container breakout through process.cwd trickery and leaked fds
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…
-
High 8.4
Access of Memory Location Before Start of Buffer in vim/vim
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
-
High 8.4
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 8.4
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
-
High 8.3
Remote Code execution in SnakeYAML
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…
-
High 8.2
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
High 8.2CVE-2022-41966 Public exploit
XStream Denial of Service via stack overflow
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack…
-
High 8.2
Apache Ivy: XML External Entity vulnerability in Apache Ivy
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML file…
-
High 8.1
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
-
High 8.1
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
-
High 8.1
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
-
High 8.1
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms…
-
High 8.1
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
-
High 8.1CVE-2020-14195 Public exploit
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
-
High 8.1CVE-2020-24616 Public exploit
Code Injection in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
-
High 8.1CVE-2020-24750 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
-
High 8.1
Serialization gadgets exploit in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
-
High 8.1
Serialization gadgets exploit in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
-
High 8.1
Serialization gadget exploit in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
-
High 8.1CVE-2020-36188 Public exploit
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
-
High 8.1
Unsafe Deserialization in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
-
High 8.1
Deserialization of untrusted data in jackson-databind
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
-
High 8.1
ECP SAML binding bypasses authentication flows
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization head…
-
High 8.1CVE-2022-24903 Public exploit
Buffer overflow in TCP syslog server (receiver) components in rsyslog
Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability…
-
High 8.1
spring-security-oauth2-client vulnerable to Privilege Escalation
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the br…
-
High 8.1
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
-
High 8.1
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
-
High 8.0
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 8.0
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
High 7.9CVE-2022-31159 Public exploit
Partial Path Traversal in com.amazonaws:aws-java-sdk-s3
The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applicatio…
-
High 7.8
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.8
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.8
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.8
global heap buffer overflow in skip_range in vim/vim
global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 7.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.
-
High 7.8
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
-
High 7.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
-
High 7.8
Integer Overflow or Wraparound in vim/vim
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0046.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.
-
High 7.8
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0213.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
-
High 7.8
Improper Validation of Specified Quantity in Input in vim/vim
Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0225.
-
High 7.8
Bypass of safe.directory protections in Git
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported …
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0246.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0286.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
-
High 7.8
Empty Cmd.Path can trigger unintended binary in os/exec on Windows
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0360.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0389.
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0490.
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0579.
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0614.
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl funct…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0789.
-
High 7.8
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, …
-
High 7.8
A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/r…
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0882.
-
High 7.8
A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters …
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 7.8
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,…
-
High 7.8
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-ist…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.
-
High 7.8
A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…
-
High 7.8
A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could u…
-
High 7.8
A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…
-
High 7.8
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…
-
High 7.8
In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow…
-
High 7.8
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible s…
-
High 7.8
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…
-
High 7.7CVE-2022-25647 EPSS 12%
Deserialization of Untrusted Data
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
-
High 7.7
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH c…
-
High 7.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0221.
-
High 7.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0260.
-
High 7.5CVE-2018-18074 Public exploit
Insufficiently Protected Credentials in Requests
The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
-
High 7.5CVE-2020-10663 Public exploit
Unsafe object creation in json RubyGem
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…
-
High 7.5
Denial of Service in Netty
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to …
-
High 7.5
Code injection in Apache Ant
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said prot…
-
High 7.5
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…
-
High 7.5CVE-2020-25649 EPSS 18%
XML External Entity (XXE) Injection in Jackson Databind
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
-
High 7.5
Timing attacks in python-rsa
It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
-
High 7.5
py vulnerable to Regular Expression Denial of Service
A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
-
High 7.5CVE-2020-36518 Public exploit
Deeply nested json in jackson-databind
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
-
High 7.5
HTTP Request Smuggling in Netty
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
-
High 7.5
Integer overflow in CipherUpdate
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
-
High 7.5
golang.org/x/net/html Infinite Loop vulnerability
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
-
High 7.5
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…
-
High 7.5
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and…
-
High 7.5
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vu…
-
High 7.5
Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…
-
High 7.5
golang.org/x/net/http2 allows uncontrolled memory consumption
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
-
High 7.5
Pac4j token validation bypass if OpenID Connect provider supports none algorithm
If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the Ope…
-
High 7.5
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc becaus…
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…
-
High 7.5
Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario w…
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
High 7.5
Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Proc…
-
High 7.5
Denial of Service (DoS)
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
-
High 7.5
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's …
-
High 7.5
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should h…
-
High 7.5
Stack exhaustion in Glob on certain paths in io/fs
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
-
High 7.5
Stack exhaustion when reading certain archives in compress/gzip
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
-
High 7.5
Stack exhaustion when unmarshaling certain documents in encoding/xml
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
-
High 7.5
Denial of service via crafted Accept-Language header in golang.org/x/text/language
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
-
High 7.5
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…
-
High 7.5
`libsqlite3-sys` via C SQLite improperly validates array index
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 7.5
Apache Ivy allows path traversal in the presence of a malicious repository
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../…
-
High 7.5
Memory leak in ECDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5
Memory leaks in EdDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5CVE-2022-40153 Rejected
DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and…
-
High 7.5CVE-2022-40303 EPSS 41%
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…
-
High 7.5
Python Charmers Future denial of service vulnerability
An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
-
High 7.5
Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTT…
-
High 7.5
Uncontrolled Resource Consumption in Jackson-databind
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
-
High 7.5
Uncontrolled Resource Consumption in FasterXML jackson-databind
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…
-
High 7.5
The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks…
-
High 7.5CVE-2022-4450 EPSS 29%
Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…
-
High 7.5
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing …
-
High 7.5CVE-2022-45688 Public exploit
json stack overflow vulnerability
A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
-
High 7.5
Use-after-free following BIO_new_NDEF
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…
-
High 7.5CVE-2023-0464 Public exploit
Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …
-
High 7.5
Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…
-
High 7.5
A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_lin…
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
High 7.5
Excessive memory allocation in net/http and net/textproto
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
High 7.5
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks duri…
-
High 7.5CVE-2023-25652 EPSS 52%
"git apply --reject" partially-controlled arbitrary file write
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with…
-
High 7.5
named's configured cache size limit can be significantly exceeded
Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size`…
-
High 7.5
moby/moby's dockerd daemon encrypted overlay network may be unauthenticated
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly …
-
High 7.5
snappy-java's unchecked chunk length leads to DoS
snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given st…
-
High 7.5
libp2p nodes vulnerable to attack using large RSA keys
go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large ke…
-
High 7.5
Missing upper bound check on chunk length in snappy-java
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bou…
-
High 7.4
CA certificate check bypass with X509_V_FLAG_X509_STRICT
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded e…
-
High 7.4
Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…
-
High 7.4
In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local …
-
High 7.4
X.400 address type confusion in X.509 GeneralName
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…
-
High 7.4
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Sup…
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Use of Uninitialized Variable in vim/vim
vim is vulnerable to Use of Uninitialized Variable
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Use after free in append_command in vim/vim
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
-
High 7.3
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
-
High 7.3
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the…
-
High 7.3
Out-of-bounds Read in vim/vim
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
-
High 7.3
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
-
High 7.3
Incorrect Calculation of Buffer Size in vim/vim
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
-
High 7.3CVE-2023-34035 Public exploit
Spring Security's authorization rules can be misconfigured when using multiple servlets
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s Dispatche…
-
High 7.2
Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using …
-
High 7.1
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.1
Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
-
High 7.1
Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
-
High 7.1
A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…
-
High 7.1
Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bou…
-
High 7.1CVE-2023-1380 EPSS 16%
A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/c…
-
High 7.1
Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, exec…
-
High 7.0
Local Temp Directory Hijacking Vulnerability
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the pr…
-
High 7.0
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition t…
-
High 7.0
Kernel: use after free bug in btsdio_remove due to race condition
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
High 7.0CVE-2023-29007 Public exploit
Arbitrary configuration injection via `git submodule deinit`
Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit…
-
Medium 6.9
Linux Kernel LoadPin bypass via dm-verity table reload
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …
-
Medium 6.8
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
Medium 6.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
-
Medium 6.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.
-
Medium 6.8
Floating Point Comparison with Incorrect Operator in vim/vim
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly r…
-
Medium 6.8
moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated
Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly …
-
Medium 6.7
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…
-
Medium 6.7
drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client …
-
Medium 6.7
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->bl…
-
Medium 6.7
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode si…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
Medium 6.7
An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because…
-
Medium 6.6
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in vim/vim prior to 8.2.
-
Medium 6.6
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash)…
-
Medium 6.6
Buffer Over-read in function grab_file_name in vim/vim
Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
-
Medium 6.6
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
-
Medium 6.6
Classic Buffer Overflow in vim/vim
Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.
-
Medium 6.6
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 8.2.4979.
-
Medium 6.6
Improper Handling of Insufficient Permissions or Privileges in MySQL Connectors Java
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to…
-
Medium 6.6
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.
-
Medium 6.6
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.
-
Medium 6.6
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user conn…
-
Medium 6.5
CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
-
Medium 6.5
The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protec…
-
Medium 6.5
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multip…
-
Medium 6.5
Possible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not furth…
-
Medium 6.5
Apache Commons Net's FTP client trusts the host from PASV response by default
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may l…
-
Medium 6.5
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …
-
Medium 6.5
Improper authorization in Keycloak
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
-
Medium 6.5
Improper sanitization of Transfer-Encoding headers in net/http
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
-
Medium 6.5
Cross site scripting in Grafana proxy
Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…
-
Medium 6.5
Out-of-bounds Write to API in vim/vim
Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100.
-
Medium 6.5
Exposure of client IP addresses in net/http
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …
-
Medium 6.5CVE-2022-32206 EPSS 36%
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …
-
Medium 6.5
DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
-
Medium 6.5
DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
-
Medium 6.5
DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
-
Medium 6.5
DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
-
Medium 6.5
Stack Buffer Overflow in Jettison
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may su…
-
Medium 6.5
Stack Buffer Overflow in Jettison
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may su…
-
Medium 6.5
Stack Buffer Overflow in xstream
Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial o…
-
Medium 6.5CVE-2022-40152 EPSS 18%
Stack Buffer Overflow in Woodstox
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effec…
-
Medium 6.5
Netty vulnerable to HTTP Response splitting from assigning header value iterator
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing ma…
-
Medium 6.5
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…
-
Medium 6.5
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…
-
Medium 6.5
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenti…
-
Medium 6.5
distribution catalog API endpoint can lead to OOM via malicious user input
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for…
-
Medium 6.5
An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HT…
-
Medium 6.5CVE-2023-2650 EPSS 75%
Possible DoS translating ASN.1 object identifiers
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …
-
Medium 6.5
netty-handler SniHandler 16MB allocation
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.…
-
Medium 6.3
Sensitive Data Exposure in Apache Ant
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the te…
-
Medium 6.3
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.
-
Medium 6.3
There is an out-of-bounds write vulnerability in vmwgfx driver
An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…
-
Medium 6.3
There is a NULL pointer vulnerability in vmwgfx driver
A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…
-
Medium 6.3
LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit…
-
Medium 6.3
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows …
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 6.3
Spring Security logout not clearing security context
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly s…
-
Medium 6.2
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…
-
Medium 6.2
Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…
-
Medium 6.2
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
-
Medium 6.2
A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Ba…
-
Medium 6.2
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 6.2CVE-2023-23946 Public exploit
Git's `git apply` overwriting paths outside the working tree
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten…
-
Medium 6.1
Cross-site Scripting in Keycloak
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
-
Medium 6.1
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
Medium 6.1
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.
-
Medium 6.1
Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
-
Medium 6.1
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
-
Medium 6.1
Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may al…
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 6.0
Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may al…
-
Medium 5.9CVE-2020-1971 Public exploit
EDIPARTYNAME NULL pointer dereference
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…
-
Medium 5.9CVE-2021-21295 EPSS 19%
Possible request smuggling in HTTP/2 due missing validation
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…
-
Medium 5.9
Possible request smuggling in HTTP/2 due missing validation of content-length
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…
-
Medium 5.9CVE-2021-23841 Public exploit
Null pointer deref in X509_issuer_and_serial_hash()
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …
-
Medium 5.9CVE-2021-2471 Public exploit
Incorrect Authorization in MySQL Connector Java
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to…
-
Medium 5.9
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a si…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.9
Race Condition in Paramiko
In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
-
Medium 5.9
Incorrect Default Permissions in runc
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an aty…
-
Medium 5.9
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw make…
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
-
Medium 5.9
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it support…
-
Medium 5.9
Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray
An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Sup…
-
Medium 5.9
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in …
-
Medium 5.9
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously…
-
Medium 5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for res…
-
Medium 5.9
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard pat…
-
Medium 5.9
snappy-java's Integer Overflow vulnerability in shuffle leads to DoS
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array o…
-
Medium 5.9
snappy-java's Integer Overflow vulnerability in compress leads to DoS
snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error. The function `compress(char[] input)` in the file `Snappy.java` receiv…
-
Medium 5.9CVE-2023-3635 Public exploit
Okio GzipSource unhandled exception Denial of Service
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
-
Medium 5.9CVE-2023-43804 Public exploit
`Cookie` HTTP header isn't stripped on cross-origin redirects
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…
-
Medium 5.8
Stack Overflow in Snakeyaml
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may suppor…
-
Medium 5.7
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
Medium 5.7
containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak
containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the us…
-
Medium 5.6
CBC padding oracle in AWS S3 Crypto SDK for GoLang
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the…
-
Medium 5.6
Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
Medium 5.5
An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unb…
-
Medium 5.5
Apache Ant TAR archive denial of service vulnerability
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.…
-
Medium 5.5
Apache Ant ZIP, and ZIP based, archive denial of service vulerability
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly …
-
Medium 5.5
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
Medium 5.5
Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
-
Medium 5.5
Out-of-bounds Read in vim/vim
Out-of-bounds Read in vim/vim prior to 8.2.
-
Medium 5.5
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff…
-
Medium 5.5
Uncontrolled Recursion in vim/vim
Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
-
Medium 5.5
Stack exhaustion due to deeply nested types in go/parser
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
-
Medium 5.5
Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable in…
-
Medium 5.5
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 5.5
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
-
Medium 5.5
containerd CRI plugin: Host memory exhaustion through ExecSync
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause co…
-
Medium 5.5
The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (app…
-
Medium 5.5CVE-2022-3542 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Medium 5.5
Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free
A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Medium 5.5
A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue funct…
-
Medium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…
-
Medium 5.5
LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a d…
-
Medium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelection…
-
Medium 5.5
LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,…
-
Medium 5.5
Linux Kernel IPsec idt77252.c tst_timer use after free
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply…
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a…
-
Medium 5.5
An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could sup…
-
Medium 5.5CVE-2022-41218 Public exploit
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…
-
Medium 5.5
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can…
-
Medium 5.5
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 5.5
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not…
-
Medium 5.5
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A…
-
Medium 5.5
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivilege…
-
Medium 5.5
processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of si…
-
Medium 5.5
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the…
-
Medium 5.5
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion …
-
Medium 5.5
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction …
-
Medium 5.5
A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-compone…
-
Medium 5.5CVE-2023-22490 Public exploit
Git vulnerable to local clone-based data exfiltration with non-local transports
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local…
-
Medium 5.5
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (sl…
-
Medium 5.5
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…
-
Medium 5.5
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…
-
Medium 5.5
Use of temporary directory for file creation in `FileBackedOutputStream` in Guava
Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary di…
-
Medium 5.5
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation…
-
Medium 5.4
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
-
Medium 5.4
Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality.
-
Medium 5.3
Cross-site scripting in Apache HttpClient
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…
-
Medium 5.3
Incorrect Default Permissions in JetBrains Kotlin
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
-
Medium 5.3
Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can ret…
-
Medium 5.3
Keycloak is vulnerable to IDN homograph attack
A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Sup…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweigh…
-
Medium 5.3CVE-2022-22976 Public exploit
Integer overflow in BCrypt class in Spring Security
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due t…
-
Medium 5.3
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
-
Medium 5.3CVE-2022-2588 Public exploit
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the …
-
Medium 5.3
Processing large delegations may severely degrade resolver performance
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
-
Medium 5.3
golang.org/x/sys/unix has Incorrect privilege reporting in syscall
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
-
Medium 5.3
Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…
-
Medium 5.3
Moby vulnerability relating to supplementary group permissions
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementa…
-
Medium 5.3CVE-2022-37436 EPSS 53%
Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by …
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Medium 5.3
HAProxyMessageDecoder Stack Exhaustion DoS
Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.F…
-
Medium 5.3
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Servi…
-
Medium 5.3
Invalid certificate policies in leaf certificates are silently ignored
Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…
-
Medium 5.3
Certificate policy check not enabled
The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Sup…
-
Medium 5.3CVE-2023-21939 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Su…
-
Medium 5.3CVE-2023-26048 Public exploit
OutOfMemoryError for large multipart without filename in Eclipse Jetty
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` wh…
-
Medium 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …
-
Medium 5.3CVE-2023-40167 Public exploit
Jetty accepts "+" prefixed value in Content-Length
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…
-
Medium 5.2
DOS vulnerability for Quoted Quality CSV headers
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 5.0
vim autocmd quickfix.c qf_update_buffer use after free
A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upg…
-
Medium 5.0
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…
-
Medium 4.8
Buffer not correctly recycled in Gzip Request inflation
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacke…
-
Medium 4.7
Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized …
-
Medium 4.7
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…
-
Medium 4.7CVE-2023-0045 Public exploit
Incorrect indirect branch prediction barrier in the Linux Kernel
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update,…
-
Medium 4.7
Red hat a-mq streams: component version with information disclosure flaw
A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access informa…
-
Medium 4.7
A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow …
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Medium 4.6
Linux Kernel Bluetooth l1oip_core.c del_timer use after free
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recomme…
-
Medium 4.6
Linux Kernel TCP tcp_setsockopt race condition
A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated wit…
-
Medium 4.6
Linux Kernel IPv6 inet6_dgram_ops race condition
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch …
-
Medium 4.6
An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs …
-
Medium 4.4
Information disclosure in JUnit4
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files a…
-
Medium 4.4
Kernel: security regression for cve-2018-13405
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a sc…
-
Medium 4.3
Linux Kernel IPv6 ipv6_renew_options memory leak
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is …
-
Medium 4.3
Linux Kernel nilfs2 inode.c nilfs_bmap_lookup_at_level null pointer dereference
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to …
-
Medium 4.3
Hazelcast vulnerable to unmasked password exposure
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
-
Medium 4.2
drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free…
-
Medium 4.2
Request body not stripped after redirect in urllib3
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…
-
Medium 4.0
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.
-
Low 3.7CVE-2020-9488 Public exploit
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.…
-
Low 3.7CVE-2021-3754 Public exploit
Keycloak's improper input validation allows using email as username
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Sup…
-
Low 3.7
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when …
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Su…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Low 3.5
Jetty vulnerable to errant command quoting in CGI Servlet
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for…
-
Low 3.5
Jetty's OpenId Revoked authentication allows one request
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revok…
-
Low 3.3
Temp directory permission issue in Guava
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on un…
-
Low 3.3
drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency…
-
Low 3.3
A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized…
-
Low 3.3
Git looks for localized messages in the wrong place
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettex…
-
Low 3.1
Linux Kernel BPF segment.c nilfs_attach_log_writer memory leak
A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initia…
-
Low 3.1
Linux Kernel BPF inode.c nilfs_new_inode use after free
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remote…
-
Low 2.9CVE-2021-34428 Public exploit
SessionListener can prevent a session from being invalidated breaking logout
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple con…
-
Low 2.7
Jetty invalid URI parsing may produce invalid HttpURI.authority
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failu…
-
Low 2.6
Linux Kernel kcm kcmsock.c kcm_tx_work race condition
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch …
-
Low 2.6
Linux Kernel af_vsock.c vsock_connect memory leak
A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. The complexity of an attack is rather high. The …
-
Low 2.5
In-band key negotiation issue in AWS S3 Crypto SDK for GoLang
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to c…
-
Low 2.4CVE-2023-26049 Public exploit
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…
-
Low 2.3
A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local acco…
-
Unscored —
libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumptio…
-
Unscored —
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …
-
Unscored —
A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could le…
-
Unscored —
A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and gen…
-
Unscored —
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakag…
-
Unscored —
Infinite loop when decoding inputs in encoding/xml
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
Revision history
-
#4
Neue Updates von IBM aufgenommen
-
#3
Neue Updates von Dell aufgenommen
-
#2
Produktzuordnung überprüft
-
#1
Initiale Fassung
References
-
Dell Security Advisory DSA-2024-141 vom 2024-04-04
https://www.dell.com/support/kbdoc/000223839/dsa-2024-=
-
Dell Security Advisory DSA-2023-014 vom 2026-01-22
https://www.dell.com/support/kbdoc/en-us/000209268/dsa-2023-014-dell-poweredge-server-security-update-for-intel-february-2023-security-advisories-2023-1-ipu
-
IBM Security Bulletin 7282698 vom 2026-08-11
https://www.ibm.com/support/pages/node/7282698