Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 193

Export CSV
CVE-2025-58713

Rhpam: privilege escalation via excessive /etc/passwd permissions

A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Enterprise Bpms Platform Process Automation and 1 more
CVE-2023-6717

Keycloak: xss via assertion consumer service url in saml post-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Build Keycloak Jboss Bpms and 13 more
CVE-2023-4853

Quarkus: http security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS 3.1 · 8.1 High EPSS 2.3% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Apache Camel Quarkus Build Of Optaplanner and 20 more
CVE-2022-44729

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Xml Graphics Batik Debian Linux Camel Spring Boot and 1 more
CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Xerces-j Active Iq Unified Manager Agile Engineering Data Management and 28 more
CVE-2021-43797

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Workflow Automation Snapcenter and 25 more
CVE-2021-37137

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Insight Netty and 21 more
CVE-2021-37136

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Insight Netty and 28 more
CVE-2021-21290

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

CVSS 3.1 · 6.2 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Active Iq Unified Manager Cloud Secure Agent and 24 more
CVE-2019-20920

nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

CVSS 3.1 · 8.1 High EPSS 3.2% KEV · Not listed
Vendors
Handlebarsjs Redhat
Products
Handlebars Jboss Enterprise Bpms Platform Openshift and 2 more
CVE-2019-20445

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVSS 3.1 · 9.1 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Spark Ubuntu Linux Debian Linux and 17 more
CVE-2019-20444

netty: HTTP request smuggling

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

CVSS 3.1 · 9.1 Critical EPSS 8.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2019-16869

netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Canonical Debian Netty and 1 more
Products
Ubuntu Linux Debian Linux Netty and 11 more
CVE-2019-14893

jackson-databind: Serialization gadgets in classes of the xalan package

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed
Vendors
Fasterxml Netapp Oracle and 1 more
Products
Jackson-databind Oncommand Api Services Steelstore Cloud Integrated Storage and 9 more
CVE-2019-10086

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS 3.1 · 7.3 High EPSS 29.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Commons Beanutils Nifi Debian Linux and 70 more
CVE-2021-37714

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Jsoup Netapp Oracle and 2 more
Products
Jsoup Management Services For Element Software And Netapp Hci Banking Trade Finance and 22 more