Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 721

Export CSV
CVE-2016-8610

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVSS 3.1 · 7.5 High EPSS 39.9% KEV · Not listed
Vendors
Debian Fujitsu Netapp and 4 more
Products
Debian Linux M10-1 M10-1 Firmware and 52 more
CVE-2017-12624

cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".

CVSS 3.0 · 5.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Enterprise Application Platform Jboss Single Sign On
CVE-2017-12629

Solr: Code execution via entity expansion

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

CVSS 3.1 · 9.8 Critical EPSS 92.5% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Solr Ubuntu Linux Debian Linux and 6 more
CVE-2017-3163

solr: Directory traversal via Index Replication HTTP API

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.

CVSS 3.0 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Apache Redhat
Products
Solr Jboss Enterprise Application Platform
CVE-2017-6056

tomcat: Infinite loop in the processing of https requests

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.

CVSS 3.0 · 7.5 High EPSS 7.6% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Jboss Enterprise Application Platform
CVE-2017-7504

jboss: JbossMQ HTTP Invocation Layer deserialization vulnerability

HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.

CVSS 3.0 · 9.8 Critical EPSS 38.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2017-7561

resteasy: Vary header not added by CORS filter leading to cache poisoning

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

CVSS 3.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2017-9788

httpd: Uninitialized memory reflection in mod_auth_digest

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.

CVSS 3.0 · 9.1 Critical EPSS 56.8% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Debian Linux and 15 more
CVE-2016-6304

openssl: OCSP Status Request extension unbounded memory growth

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

CVSS 3.1 · 7.5 High EPSS 63.0% KEV · Not listed
Vendors
Nodejs Novell Openssl and 1 more
Products
Node.js Suse Linux Enterprise Module For Web Scripting Openssl and 8 more
CVE-2016-7065

JBoss EAP 5 JMX servlet deserializes Java objects sent via HTTP

The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.

CVSS 3.0 · 8.8 High EPSS 12.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2013-6438

httpd: mod_dav denial of service via crafted DAV WRITE request

The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

CVSS 2.0 · 5.0 Medium EPSS 27.5% KEV · Not listed
Vendors
Apache Canonical Oracle and 1 more
Products
Http Server Ubuntu Linux Http Server and 3 more
CVE-2016-7046

undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS

Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.

CVSS 3.0 · 5.9 Medium EPSS 2.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2014-0005

PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application

PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 3 more
CVE-2012-6153

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

CVSS 2.0 · 4.3 Medium EPSS 5.8% KEV · Not listed
Vendors
Apache Redhat
Products
Commons-httpclient Developer Toolset Jboss Bpms and 10 more
CVE-2014-0034

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

CVSS 2.0 · 4.3 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0035

CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 4.3 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0058

EAP6: Plain text password logging during security audit

The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 5 more
CVE-2014-0059

JBossSX/PicketBox: World readable audit.log file

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more