Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 403

Export CSV
CVE-2020-28052

bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

CVSS 3.1 · 8.1 High EPSS 7.2% KEV · Not listed
Vendors
Apache Bouncycastle Oracle and 1 more
Products
Karaf Bc-java Banking Corporate Lending Process Management and 24 more
CVE-2022-4244

Codehaus-plexus: directory traversal

A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Codehaus-plexus Redhat
Products
Plexus-utils A Mq Clients Amq Broker and 20 more
CVE-2020-25638

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 7.4 High EPSS 2.9% KEV · Not listed
Vendors
Debian Hibernate Oracle and 2 more
Products
Debian Linux Hibernate Orm Communications Cloud Native Core Console and 12 more
CVE-2022-45693

jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Debian Jettison Project Redhat
Products
Debian Linux Jettison Camel Spring Boot and 7 more
CVE-2022-46364

Apache CXF SSRF Vulnerability

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Camel Spring Boot Jboss Enterprise Application Platform and 7 more
CVE-2022-46363

Apache CXF directory listing / code exfiltration

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Camel K Camel Spring Boot and 6 more
CVE-2022-40149

Stack Buffer Overflow in Jettison

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Jettison Project Redhat
Products
Debian Linux Jettison Amq Streams and 8 more
CVE-2022-40150

Stack Buffer Overflow in Jettison

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Jettison Project Redhat
Products
Debian Linux Jettison Amq Streams and 8 more
CVE-2017-12158

keycloak: reflected XSS using HOST header

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

CVSS 3.0 · 5.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Enterprise Linux Server Jboss Single Sign On and 2 more
CVE-2017-12159

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Enterprise Linux Server Jboss Single Sign On and 2 more
CVE-2017-12160

keycloak: resource privilege extension via access token in oauth

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.

CVSS 3.1 · 7.2 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Red Hat Single Sign On
CVE-2021-35065

glob-parent: Regular Expression Denial of Service

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Gulpjs Redhat
Products
Glob-parent Enterprise Linux Logging and 5 more
CVE-2022-45787

Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Redhat
Products
James Jboss Enterprise Application Platform Quarkus and 3 more
CVE-2023-0091

keycloak: Client Registration endpoint does not check token revocation

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On Rhosemc and 1 more
CVE-2023-0105

keycloak: impersonation and lockout possible through incorrect handling of email trust

A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On Rhosemc and 1 more
CVE-2022-3782

keycloak: path traversal via double URL encoding

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

CVSS 3.1 · 9.1 Critical EPSS 6.2% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Jboss Enterprise Bpms Platform Keycloak and 5 more
CVE-2022-4492

undertow: Server identity in https connection is not checked by the undertow client

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Camel Spring Boot Integration Camel For Spring Boot and 14 more