Vendor
[UNKNOWN]
239 known vulnerabilities.
Products
239 results · Feed
-
High 7.5
A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read ac…
-
High 8.8
Moodle Cross-site Scripting
moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could…
-
High 8.8
Moodle XML import of ddwtos could lead to intentional remote code execution
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PH…
-
Medium 5.3
A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from w…
-
High 7.5
A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the…
-
High 7.5CVE-2018-14618 EPSS 11%
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Cur…
-
Medium 5.3
The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is require…
-
High 8.1CVE-2018-10936 Public exploit
Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker coul…
-
Medium 5.3
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xpr…
-
Medium 5.3
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than …
-
Medium 6.2
A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was be…
-
Medium 5.3
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was fo…
-
Medium 5.9
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote att…
-
Medium 5.9
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote att…
-
High 8.3
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages …
-
Medium 6.8
pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repo…
-
Medium 5.3
An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. …
-
High 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a direct…
-
Medium 5.0
The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privilege…
-
Medium 6.5
It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploa…
-
Low 3.7
Emails were sent to addresses not associated with actual users of Jenkins by Email Extension Plugin
jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. T…
-
Medium 4.3
Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially l…
-
High 7.5
An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of s…
-
Medium 5.3
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leadin…
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
High 8.8
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director usi…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_d…
-
High 7.5
PyCA Cryptography vulnerable to GCM tag forgery
A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid …
-
High 7.1
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the s…
-
Medium 5.5
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in E…
-
Medium 4.8
A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/tran…
-
Medium 4.1
The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacke…
-
High 7.5
Moderate severity vulnerability that affects io.undertow:undertow-core
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
-
High 7.7
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…
-
Low 2.3
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an applic…
-
Medium 6.5CVE-2017-2666 Public exploit
Undertow-core vulnerable to HTTP Request Smuggling
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…
-
Medium 6.5
It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks d…
-
Medium 6.5
It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when u…
-
Medium 5.9
An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperl…
-
High 8.7
It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE fl…