Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 276

Export CSV
CVE-2010-1623

apr-util: high memory consumption in apr_brigade_split_line()

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.

CVSS 2.0 · 5.0 Medium EPSS 20.3% KEV · Not listed
Vendors
Apache Redhat
Products
Apr-util Http Server Enterprise Linux and 1 more
CVE-2010-1452

mod_dav: DoS (httpd child process crash) by parsing URI structure with missing path segments

The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.

CVSS 2.0 · 5.0 Medium EPSS 21.4% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Enterprise Web Server
CVE-2010-1157

tomcat: information disclosure in authentication headers

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.

CVSS 2.0 · 2.6 Low EPSS 52.5% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Jboss Enterprise Application Platform Jboss Enterprise Web Server
CVE-2010-0434

httpd: request header information leak

The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.

CVSS 2.0 · 4.3 Medium EPSS 18.4% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 1 more
Products
Http Server Debian Linux Fedora and 3 more
CVE-2010-0408

httpd: mod_proxy_ajp remote temporary DoS

The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.

CVSS 2.0 · 5.0 Medium EPSS 20.9% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Enterprise Web Server
CVE-2009-3245

openssl: missing bn_wexpand return value checks

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Enterprise Web Server
CVE-2009-2902

tomcat: unexpected file deletion in work directory

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

CVSS 2.0 · 4.3 Medium EPSS 10.7% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 2 more
CVE-2009-2693

tomcat: unexpected file deletion and/or alteration

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

CVSS 2.0 · 5.8 Medium EPSS 9.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 2 more
CVE-2022-28331

Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Apache Microsoft Redhat
Products
Portable Runtime Windows Jboss Core Services and 1 more
CVE-2022-24963

Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Apache Redhat
Products
Portable Runtime Enterprise Linux Jboss Core Services and 1 more
CVE-2023-28709

Apache Tomcat: Fix for CVE-2023-24998 is incomplete

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

CVSS 3.1 · 7.5 High EPSS 48.0% KEV · Not listed
Vendors
Apache Debian Netapp and 1 more
Products
Tomcat Debian Linux 7-mode Transition Tool and 2 more
CVE-2021-22696

OAuth 2 authorization service vulnerable to DDos attacks

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Business Intelligence Communications Diameter Intelligence Hub and 5 more
CVE-2022-4245

Codehaus-plexus: xml external entity (xxe) injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Codehaus-plexus Redhat
Products
Plexus-utils A Mq Clients Amq Broker and 20 more
CVE-2022-45143

Apache Tomcat: JsonErrorReportValve escaping

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Jboss Enterprise Web Server Jboss Fuse and 1 more
CVE-2022-23181

Local privilege escalation with FileStore

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Tomcat Debian Linux Agile Engineering Data Management and 7 more
CVE-2021-42340

DoS via memory leak with WebSocket connections

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

CVSS 3.1 · 7.5 High EPSS 11.8% KEV · Not listed
Vendors
Apache Debian Netapp and 2 more
Products
Tomcat Debian Linux Hci and 19 more
CVE-2021-30468

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Tomee Business Intelligence and 5 more
CVE-2021-23841

Null pointer deref in X509_issuer_and_serial_hash()

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

CVSS 3.1 · 5.9 Medium EPSS 7.5% KEV · Not listed
Vendors
Apple Debian Netapp and 5 more
Products
Ipados Iphone Os Macos and 24 more
CVE-2019-1559

0-byte record padding oracle

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

CVSS 3.1 · 5.9 Medium EPSS 17.1% KEV · Not listed
Vendors
Canonical Debian F5 and 10 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 88 more