Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 604

Export CSV
CVE-2021-43797

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Workflow Automation Snapcenter and 25 more
CVE-2021-3449

NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

CVSS 3.1 · 5.9 Medium EPSS 63.5% KEV · Not listed
Vendors
Checkpoint Debian Fedoraproject and 10 more
Products
Multi-domain Management Multi-domain Management Firmware Quantum Security Gateway and 169 more
CVE-2021-21290

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

CVSS 3.1 · 6.2 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Active Iq Unified Manager Cloud Secure Agent and 24 more
CVE-2020-5398

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

CVSS 3.1 · 7.5 High EPSS 88.3% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Data Availability Services Snapcenter Application Testing Suite and 31 more
CVE-2020-17521

groovy: OS temporary directory leads to information disclosure

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Atlas Groovy Snapcenter and 21 more
CVE-2019-10219

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Element Management Services For Element Software And Netapp Hci and 195 more
CVE-2018-0734

Timing attack against DSA

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

CVSS 3.1 · 5.9 Medium EPSS 12.2% KEV · Not listed
Vendors
Canonical Debian Netapp and 4 more
Products
Ubuntu Linux Debian Linux Cloud Backup and 20 more
CVE-2017-7525

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVSS 3.1 · 9.8 Critical EPSS 37.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Oncommand Balance and 27 more
CVE-2017-5645

log4j: Socket receiver deserialization vulnerability

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 89.4% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Log4j Oncommand Api Services Oncommand Insight and 83 more
CVE-2017-15095

jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.

CVSS 3.1 · 9.8 Critical EPSS 8.4% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Oncommand Balance and 28 more
CVE-2021-3711

SM2 Decryption Buffer Overflow

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

CVSS 3.1 · 9.8 Critical EPSS 87.8% KEV · Not listed
Vendors
Debian Netapp Openssl and 3 more
Products
Debian Linux Active Iq Unified Manager Clustered Data Ontap and 29 more
CVE-2020-5421

RFD Protection Bypass via jsessionid

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Oncommand Insight Snap Creator Framework Snapcenter and 36 more
CVE-2020-1967

Segmentation fault in SSL_check_chain

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

CVSS 3.1 · 7.5 High EPSS 53.3% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 7 more
Products
Fabric Operating System Debian Linux Fedora and 23 more
CVE-2019-14379

jackson-databind: default typing mishandling leading to remote code execution

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.0% KEV · Not listed
Vendors
Apple Debian Fasterxml and 4 more
Products
Xcode Debian Linux Jackson-databind and 34 more
CVE-2018-14719

jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

CVSS 3.1 · 9.8 Critical EPSS 9.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Oncommand Workflow Automation and 28 more
CVE-2020-13956

apache-httpclient: incorrect handling of malformed authority component in request URIs

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

CVSS 3.1 · 5.3 Medium EPSS 9.0% KEV · Not listed
Vendors
Apache Netapp Oracle and 2 more
Products
Httpclient Active Iq Unified Manager Snapcenter and 24 more
CVE-2018-1258

spring-security-core: Unauthorized Access with Spring Security Method Security

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Netapp Oracle Pivotal Software and 2 more
Products
Oncommand Insight Oncommand Unified Manager Oncommand Workflow Automation and 40 more
CVE-2020-10683

dom4j: XML External Entity vulnerability in default SAX parser

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

CVSS 3.1 · 9.8 Critical EPSS 7.3% KEV · Not listed
Vendors
Canonical Dom4j Project Netapp and 3 more
Products
Ubuntu Linux Dom4j Oncommand Api Services and 41 more