Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2021-28165

jetty: Resource exhaustion when receiving an invalid large TLS frame

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 3.1 · 7.5 High EPSS 53.9% KEV · Not listed
Vendors
Eclipse Jenkins Netapp and 2 more
Products
Jetty Jenkins Cloud Manager and 25 more
CVE-2019-12814

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

CVSS 3.1 · 5.9 Medium EPSS 10.9% KEV · Not listed
Vendors
Debian Fasterxml Redhat
Products
Debian Linux Jackson-databind Amq Streams and 9 more
CVE-2017-17485

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

CVSS 3.1 · 9.8 Critical EPSS 49.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 1 more
Products
Debian Linux Jackson-databind E-series Santricity Os Controller and 12 more
CVE-2020-27223

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

CVSS 3.1 · 5.2 Medium EPSS 78.0% KEV · Not listed
Vendors
Apache Debian Eclipse and 3 more
Products
Nifi Solr Spark and 19 more
CVE-2017-2617

Hawtio: Unrestricted file upload leads to RCE

hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed.

CVSS 3.0 · 7.6 High EPSS 1.7% KEV · Not listed
Vendors
Hawt Redhat
Products
Hawtio Jboss Amq Jboss Fuse
CVE-2020-15522

bouncycastle: Timing issue within the EC math library

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

CVSS 3.1 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-csharp Bouncy Castle Fips .net Api Fips Java Api and 5 more
CVE-2024-28752

Apache CXF SSRF Vulnerability using the Aegis databinding

A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted.

CVSS 3.1 · 9.3 Critical EPSS 3.1% KEV · Not listed
Vendors
Apache Netapp Redhat
Products
Cxf Oncommand Workflow Automation Ontap Tools and 6 more
CVE-2023-1932

Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hibernate Redhat
Products
Hibernate-validator A Mq Clients Amq Broker and 21 more
CVE-2023-36479

Jetty vulnerable to errant command quoting in CGI Servlet

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

CVSS 3.1 · 3.5 Low EPSS 1.2% KEV · Not listed
Vendors
Debian Eclipse Redhat
Products
Debian Linux Jetty Jboss Fuse and 4 more
CVE-2022-41966

XStream Denial of Service via stack overflow

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.

CVSS 3.1 · 8.2 High EPSS 9.3% KEV · Not listed
Vendors
Redhat Xstream
Products
Camel Quarkus Camel Spring Boot Jboss Enterprise Bpms Platform and 7 more
CVE-2019-10173

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

CVSS 3.1 · 9.8 Critical EPSS 95.0% KEV · Not listed
Vendors
Oracle Redhat Xstream
Products
Banking Platform Business Activity Monitoring Communications Billing And Revenue Management Elastic Charging Engine and 12 more
CVE-2016-1000352

bouncycastle: ECIES implementation allowed the use of ECB mode

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

CVSS 3.0 · 7.4 High EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2016-1000346

bouncycastle: Other party DH public keys are not fully validated

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

CVSS 3.0 · 3.7 Low EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000340

bouncycastle: Carry propagation bug in math.raw.Nat??? class

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2013-1624

bouncycastle: TLS CBC padding timing attack

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

CVSS 2.0 · 4.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Legion-of-the-bouncy-castle-c\#-cryptography-api Jboss Amq and 5 more
CVE-2020-28052

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

CVSS 3.1 · 8.1 High EPSS 7.2% KEV · Not listed
Vendors
Apache Bouncycastle Oracle and 1 more
Products
Karaf Bc-java Banking Corporate Lending Process Management and 24 more
CVE-2016-1000339

bouncycastle: Information leak in AESFastEngine class

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.

CVSS 3.0 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000341

bouncycastle: Information exposure in DSA signature generation via timing attack

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

CVSS 3.0 · 5.9 Medium EPSS 2.5% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more