Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 330

Export CSV
CVE-2016-9598

libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Jboss Core Services Libxml2
CVE-2016-9597

libxml2: stack overflow before detecting invalid XML file (unfixed CVE-2016-3705 in JBCS)

It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Hp and 3 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 4 more
CVE-2016-9596

libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Jboss Core Services Libxml2
CVE-2016-8625

curl: IDNA 2003 makes curl use wrong host

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

CVSS 3.0 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8618

curl: Double-free in curl_maprintf

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.

CVSS 3.0 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8616

curl: Case insensitive password comparison

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.

CVSS 3.0 · 3.7 Low EPSS 3.5% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8612

mod_cluster: Protocol parsing logic error

Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.

CVSS 3.0 · 4.3 Medium EPSS 4.4% KEV · Not listed
Vendors
Apache Netapp Redhat
Products
Http Server Storage Automation Store Enterprise Linux and 1 more
CVE-2016-7056

openssl: ECDSA P-256 timing attack key recovery

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Openssl and 1 more
Products
Ubuntu Linux Debian Linux Openssl and 3 more
CVE-2016-4975

mod_userdir CRLF injection

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

CVSS 3.0 · 6.1 Medium EPSS 19.9% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services