Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2018-1000180

bouncycastle: flaw in the low-level interface to RSA key pair generator

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Bouncycastle Debian Netapp and 2 more
Products
Bc-java Fips Java Api Debian Linux and 21 more
CVE-2016-1000352

bouncycastle: ECIES implementation allowed the use of ECB mode

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

CVSS 3.0 · 7.4 High EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2016-1000346

bouncycastle: Other party DH public keys are not fully validated

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

CVSS 3.0 · 3.7 Low EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000340

bouncycastle: Carry propagation bug in math.raw.Nat??? class

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2013-1624

bouncycastle: TLS CBC padding timing attack

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

CVSS 2.0 · 4.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Legion-of-the-bouncy-castle-c\#-cryptography-api Jboss Amq and 5 more
CVE-2023-50290

Apache Solr: Host environment variables are published via the Metrics API

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0. Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.

CVSS 3.1 · 6.5 Medium EPSS 68.4% KEV · Not listed
Vendors
Apache Redhat
Products
Solr Jboss Fuse
CVE-2022-31692

spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Netapp Redhat Vmware
Products
Active Iq Unified Manager Jboss Fuse Openshift and 1 more
CVE-2022-23596

Infinite loop in junrar

Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Junrar Project Redhat
Products
Junrar Jboss Fuse
CVE-2022-23221

h2: Loading of custom classes from remote servers through JNDI

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

CVSS 3.1 · 9.8 Critical EPSS 64.8% KEV · Not listed
Vendors
Debian H2database Oracle and 1 more
Products
Debian Linux H2 Communications Cloud Native Core Console and 3 more
CVE-2022-21724

Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 7 High EPSS 3.1% KEV · Not listed
Vendors
Debian Fedoraproject Postgresql and 2 more
Products
Debian Linux Fedora Postgresql Jdbc Driver and 5 more
CVE-2016-1000338

bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Bouncycastle Canonical Netapp and 1 more
Products
Legion-of-the-bouncy-castle-java-crytography-api Ubuntu Linux 7-mode Transition Tool and 3 more
CVE-2022-4244

Codehaus-plexus: directory traversal

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Codehaus-plexus Redhat
Products
Plexus-utils A Mq Clients Amq Broker and 20 more
CVE-2020-25638

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 7.4 High EPSS 2.9% KEV · Not listed
Vendors
Debian Hibernate Oracle and 2 more
Products
Debian Linux Hibernate Orm Communications Cloud Native Core Console and 12 more
CVE-2022-24723

Improper Input Validation in URI.js

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Uri.js Project
Products
Acm Jboss Fuse Uri.js
CVE-2022-24823

Local Information Disclosure Vulnerability in io.netty:netty-codec-http

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Netapp Netty Oracle and 1 more
Products
Active Iq Unified Manager Oncommand Workflow Automation Snapcenter and 7 more
CVE-2022-46364

Apache CXF SSRF Vulnerability

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Camel Spring Boot Jboss Enterprise Application Platform and 7 more
CVE-2022-46363

Apache CXF directory listing / code exfiltration

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Camel K Camel Spring Boot and 6 more
CVE-2021-22569

Denial of Service of protobuf-java parsing procedure

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Google-protobuf Protobuf-java Protobuf-kotlin and 11 more
CVE-2022-41853

Remote code execution in HyperSQL DataBase

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

CVSS 3.1 · 8 High EPSS 5.1% KEV · Not listed
Vendors
Debian Hsqldb Redhat
Products
Debian Linux Hypersql Database Camel Spring Boot and 5 more
CVE-2016-9879

Security: Improper handling of path parameters allows bypassing the security constraint

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.

CVSS 3.0 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Ibm Redhat Vmware
Products
Websphere Application Server Jboss Amq Jboss Fuse and 1 more