Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 329

Export CSV
CVE-2013-2099

python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns

Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) via multiple wildcard characters in the common name in a certificate.

CVSS 2.0 · 4.3 Medium EPSS 4.9% KEV · Not listed
Vendors
Canonical Python Redhat
Products
Ubuntu Linux Python Openstack and 5 more
CVE-2023-23969

python-django: Potential denial-of-service via Accept-Language headers

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

CVSS 3.1 · 7.5 High EPSS 47.4% KEV · Not listed
Vendors
Debian Djangoproject Redhat
Products
Debian Linux Django Rhui and 2 more
CVE-2023-24580

python-django: Potential denial-of-service vulnerability in file uploads

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 62.6% KEV · Not listed
Vendors
Debian Djangoproject Redhat
Products
Debian Linux Django Ansible Automation Platform and 3 more
CVE-2021-46877

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Fasterxml Redhat
Products
Jackson-databind Amq Streams Camel Spring Boot and 12 more
CVE-2024-26146

Possible Denial of Service Vulnerability in Rack Header Parsing

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

CVSS 3.1 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Rack Rack Project and 1 more
Products
Debian Linux Rack Rack and 6 more
CVE-2024-25126

Rack ReDos in content type parsing (2nd degree polynomial)

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

CVSS 3.1 · 5.3 Medium EPSS 35.4% KEV · Not listed
Vendors
Debian Rack Rack Project and 1 more
Products
Debian Linux Rack Rack and 6 more
CVE-2024-26141

Possible DoS Vulnerability with Range Header in Rack

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

CVSS 3.1 · 5.8 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Rack Rack Project and 1 more
Products
Debian Linux Rack Rack and 6 more
CVE-2023-3592

mosquitto: memory leak leads to unresponsive broker

In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Mosquitto Satellite Satellite Capsule
CVE-2023-32681

Unintended leak of Proxy-Authorization header in requests

Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.

CVSS 3.1 · 6.1 Medium EPSS 3.0% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Requests Ansible Automation Platform and 5 more
CVE-2023-40167

Jetty accepts "+" prefixed value in Content-Length

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Eclipse Redhat
Products
Debian Linux Jetty Amq Broker and 8 more
CVE-2023-26049

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 2.4 Low EPSS 1.3% KEV · Not listed
Vendors
Debian Eclipse Netapp and 1 more
Products
Debian Linux Jetty Active Iq Unified Manager and 12 more
CVE-2022-34265

python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

CVSS 3.1 · 9.8 Critical EPSS 73.6% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Rhui Satellite and 1 more
CVE-2022-28347

Django: SQL injection via QuerySet.explain(options) on PostgreSQL

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Djangoproject Redhat
Products
Debian Linux Django Ansible Automation Platform and 3 more
CVE-2022-28346

Django: SQL injection in QuerySet.annotate(),aggregate() and extra()

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

CVSS 3.1 · 9.8 Critical EPSS 18.7% KEV · Not listed
Vendors
Debian Djangoproject Redhat
Products
Debian Linux Django Ansible Automation Platform and 4 more
CVE-2019-0231

Apache MINA SSLFilter security Issue

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Apache Redhat
Products
Mina Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform and 3 more
CVE-2022-44572

rubygem-rack: denial of service in Content-Disposition parsing

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Rack Redhat
Products
Rack Satellite Satellite Capsule
CVE-2022-44570

rubygem-rack: denial of service in Content-Disposition parsing

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Rack Redhat
Products
Rack Satellite Satellite Capsule
CVE-2019-16782

Possible Information Leak / Session Hijack Vulnerability in Rack

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

CVSS 3.1 · 6.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Opensuse Rack and 1 more
Products
Fedora Leap Rack and 3 more
CVE-2023-27530

rubygem-rack: Denial of service in Multipart MIME parsing

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Debian Rack Redhat
Products
Debian Linux Rack Enterprise Linux and 3 more