Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2017-12626

poi: Parsing of multiple file types can cause a denial of service via infinite loop or out of memory exception

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

CVSS 3.1 · 7.5 High EPSS 10.1% KEV · Not listed
Vendors
Apache Redhat
Products
Poi Jboss Amq Jboss Fuse
CVE-2022-23302

Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS 3.1 · 8.8 High EPSS 63.8% KEV · Not listed
Vendors
Apache Broadcom Netapp and 3 more
Products
Log4j Brocade Sannav Snapmanager and 41 more
CVE-2022-23305

SQL injection in JDBC Appender in Apache Log4j V1

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS 3.1 · 9.8 Critical EPSS 66.5% KEV · Not listed
Vendors
Apache Broadcom Netapp and 3 more
Products
Log4j Brocade Sannav Snapmanager and 43 more
CVE-2022-23307

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CVSS 3.1 · 8.8 High EPSS 54.4% KEV · Not listed
Vendors
Apache Oracle Qos and 1 more
Products
Chainsaw Log4j Advanced Supply Chain Planning and 41 more
CVE-2016-4437

shiro: Security constraint bypass

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

CVSS 3.1 · 9.8 Critical EPSS 93.0% KEV · Listed
Vendors
Apache Redhat
Products
Aurora Shiro Fuse and 3 more
CVE-2014-3120

elasticsearch: remote code execution flaw via dynamic scripting

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

CVSS 3.1 · 8.1 High EPSS 88.6% KEV · Listed
Vendors
Elastic Redhat Rhel Sam
Products
Elasticsearch Fuse Esb Enterprise Fuse Management Console and 4 more
CVE-2015-1427

elasticsearch: remote code execution via Groovy sandbox bypass

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Listed
Vendors
Elastic Redhat
Products
Elasticsearch Fuse Jboss Amq and 1 more
CVE-2016-3088

activemq: Fileserver web application vulnerability allowing RCE

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

CVSS 3.1 · 9.8 Critical EPSS 98.4% KEV · Listed
Vendors
Apache Redhat
Products
Activemq Jboss Amq Jboss Fuse
CVE-2025-7195

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Security Apicurio Registry and 10 more
CVE-2023-4639

Undertow: cookie smuggling/spoofing

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

CVSS 3.1 · 7.4 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Camel Spring Boot Integration and 11 more
CVE-2024-6162

Undertow: url-encoded request path information can be broken on ajp-listener

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio Apache Camel Spring Boot Build Keycloak and 8 more
CVE-2024-22257

spring-security: Broken Access Control With Direct Use of AuthenticatedVoter

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Security Apache Camel Spring Boot Jboss Fuse
CVE-2024-22243

CVE-2024-22243: Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

CVSS 3.1 · 8.1 High EPSS 4.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Fuse
CVE-2020-29582

kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Jetbrains Oracle Redhat
Products
Kotlin Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core Policy and 4 more
CVE-2022-1650

Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed
Vendors
Debian Eventsource Redhat
Products
Debian Linux Eventsource Ceph Storage and 8 more
CVE-2019-10768

AngularJS: Prototype pollution in merge function could result in code injection

In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Angularjs Redhat
Products
Angularjs Amq Broker Jboss Fuse and 1 more
CVE-2020-7676

nodejs-angular: XSS due to regex-based HTML replacement

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.

CVSS 3.1 · 5.4 Medium EPSS 1.9% KEV · Not listed
Vendors
Angularjs Redhat
Products
Angularjs Amq Broker Ansible Tower and 2 more
CVE-2024-10234

Wildfly: wildfly vulnerable to cross-site scripting (xss)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Data Grid and 5 more
CVE-2024-1102

Jberet: jberet-core logging database credentials

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jberet Redhat
Products
Jberet Build Keycloak Jboss Data Grid and 4 more
CVE-2023-46604

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVSS 3.1 · 10 Critical EPSS 100.0% KEV · Listed
Vendors
Apache Debian Netapp and 1 more
Products
Activemq Activemq Legacy Openwire Module Debian Linux and 7 more