Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 757

Export CSV
CVE-2011-3344

Spacewalk: spacewalk: cross-site scripting via uri in lookup login/password form

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Rhel Els Spacewalk
CVE-2011-2927

Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms

A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or HTML into web pages viewed by other users. The flaw is triggered through vectors related to Search forms, enabling attackers to potentially steal sensitive information or perform actions on behalf of the victim.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Rhel Els Spacewalk
CVE-2011-2920

Spacewalk: spacewalk: cross-site scripting vulnerability allows arbitrary web script execution.

A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicious code in a user's web browser, potentially compromising user sessions or disclosing sensitive information.

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Rhel Els Spacewalk
CVE-2009-4139

Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Network Satellite Server Rhel Els and 1 more
CVE-2012-0059

Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

CVSS 3.1 · 4.9 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Network Proxy Network Satellite Rhel Els and 1 more
CVE-2011-1594

Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Rhel Els Spacewalk
CVE-2006-4339

Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass

A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.

CVSS 3.1 · 9.1 Critical EPSS 3.9% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Core Services and 4 more
CVE-2011-4346

Satellite: xss in custom system information key handling

Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.

CVSS 3.1 · 4.6 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Network Satellite Satellite
CVE-2013-2056

Red hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypass

A flaw was found in Red Hat Network Satellite. The Inter-Satellite Sync (ISS) operation, which synchronizes data between satellites, does not properly verify the authenticity of clients. This allows remote attackers to bypass the initial authentication process and obtain sensitive channel content. This vulnerability leads to unauthorized information disclosure.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Satellite
CVE-2018-11212

libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Ijg and 4 more
Products
Ubuntu Linux Debian Linux Libjpeg and 13 more
CVE-2016-10165

lcms2: Out-of-bounds read in Type_MLU_Read()

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVSS 3.1 · 7.1 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Littlecms and 3 more
Products
Ubuntu Linux Debian Linux Little Cms Color Engine and 20 more
CVE-2016-0494

ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.2% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 4 more
CVE-2016-0483

OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017)

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.

CVSS 2.0 · 10.0 Critical EPSS 14.7% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 5 more
CVE-2016-0466

OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 4 more
CVE-2016-0448

OpenJDK: logging of RMI connection secrets (JMX, 8130710)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.

CVSS 2.0 · 4.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 4 more
CVE-2016-0402

OpenJDK: URL deserialization inconsistencies (Networking, 8059054)

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 4 more
CVE-2015-8126

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

CVSS 2.0 · 7.5 High EPSS 10.3% KEV · Not listed
Vendors
Apple Canonical Debian and 6 more
Products
Mac Os X Ubuntu Linux Debian Linux and 21 more
CVE-2015-7575

TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

CVSS 3.0 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Network Security Services and 6 more
CVE-2015-4903

OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4893

OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 4 more