Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2018-12547

JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()

In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Eclipse Redhat
Products
Openj9 Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2018-12544

vertx: API Validation XML Schemas do not forbid file system access

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

CVSS 3.0 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x Openshift Application Runtimes
CVE-2018-12541

vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x Jboss Fuse Openshift Application Runtimes
CVE-2018-12540

vertx-web: Incomplete CSRF validation by CSRFHandler

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.

CVSS 3.0 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x Openshift Application Runtimes
CVE-2018-12539

JDK: privilege escalation via insufficiently restricted access to Attach API

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Eclipse Oracle Redhat
Products
Openj9 Enterprise Manager Base Platform Network Satellite and 1 more
CVE-2018-12537

vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x Jboss Fuse Openshift Application Runtimes
CVE-2018-12536

jetty: full server path revealed when using the default Error Handling

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

CVSS 3.1 · 5.3 Medium EPSS 4.2% KEV · Not listed
Vendors
Eclipse Oracle Redhat
Products
Jetty Retail Xstore Point Of Service Jboss Fuse
CVE-2018-12533

RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

CVSS 3.0 · 9.8 Critical EPSS 18.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Operations Network Richfaces
CVE-2018-12532

RichFaces: Injection of arbitrary EL variable mapper allows to bypass mitigation of CVE-2015-0279 and thereby remote code execution

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.

CVSS 3.0 · 9.8 Critical EPSS 6.8% KEV · Not listed
Vendors
Redhat
Products
Richfaces
CVE-2018-12404

nss: Cache side-channel variant of the Bleichenbacher attack

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

CVSS 3.0 · 5.9 Medium EPSS 44.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Network Security Services Ansible Tower Enterprise Linux
CVE-2018-12396

Mozilla: WebExtension content scripts can execute in disallowed contexts

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2018-12395

Mozilla: WebExtension bypass of domain restrictions through header rewriting

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 6 more
CVE-2018-12393

Mozilla: Integer overflow during Unicode conversion while loading JavaScript

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12385

Mozilla: Crash in TransportSecurityInfo due to cached data

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12384

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.

CVSS 3.0 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Network Security Services Enterprise Linux
CVE-2018-12383

Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more
CVE-2018-12374

thunderbird: Using form to exfiltrate encrypted mail part by pressing enter in form field

Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.

CVSS 3.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Thunderbird and 4 more
CVE-2018-12373

thunderbird: S/MIME plaintext can be leaked through HTML reply/forward

dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Thunderbird and 4 more
CVE-2018-12372

thunderbird: S/MIME and PGP decryption oracles can be built with HTML emails

Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Thunderbird and 4 more