Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2022-44571

rubygem-rack: denial of service in Content-Disposition parsing

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Rack Redhat
Products
Rack Satellite Satellite Capsule
CVE-2022-44572

rubygem-rack: denial of service in Content-Disposition parsing

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Rack Redhat
Products
Rack Satellite Satellite Capsule
CVE-2019-16782

Possible Information Leak / Session Hijack Vulnerability in Rack

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

CVSS 3.1 · 6.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Opensuse Rack and 1 more
Products
Fedora Leap Rack and 3 more
CVE-2024-26130

cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cryptography.io Redhat
Products
Cryptography Ansible Automation Platform Rhui and 2 more
CVE-2023-1894

puppet: Puppet Server ReDoS

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Puppet Redhat
Products
Puppet Enterprise Puppet Server Satellite and 1 more
CVE-2023-31047

python-django: Potential bypass of validation when uploading multiple files using one form field

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Rhui and 2 more
CVE-2023-22796

rubygem-activesupport: Regular Expression Denial of Service

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Activesupport Project Redhat
Products
Activesupport Logging Satellite
CVE-2019-12387

python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

CVSS 3.1 · 6.1 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Fedoraproject Oracle and 2 more
Products
Ubuntu Linux Fedora Solaris and 5 more
CVE-2016-1000111

Twisted: sets environmental variable based on user supplied Proxy request header

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat Twisted
Products
Enterprise Linux Satellite Satellite Capsule and 1 more
CVE-2023-40175

Inconsistent Interpretation of HTTP Requests in puma

Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Puma Redhat
Products
Puma Satellite
CVE-2023-37276

aiohttp vulnerable to HTTP request smuggling

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Aio-libs Project Aiohttp Redhat
Products
Aiohttp Aiohttp Rhui and 2 more
CVE-2023-26141

sidekiq: DoS in dashboard-charts

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Contribsys Redhat
Products
Sidekiq Satellite
CVE-2023-22799

rubygem-globalid: ReDoS vulnerability

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Satellite Globalid
CVE-2023-22795

rubygem-actionpack: Denial of Service in Action Dispatch

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Debian Redhat Ruby-lang and 1 more
Products
Debian Linux Satellite Ruby and 1 more
CVE-2023-22794

rubygem-activerecord: SQL Injection

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Activerecord Project Redhat
Products
Activerecord Satellite
CVE-2023-1832

Improper authorization check in the server component

An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Candlepinproject Redhat
Products
Candlepin Satellite
CVE-2023-0462

Arbitrary code execution through yaml global parameters

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Satellite Utils and 1 more
CVE-2023-0119

Foreman: stored cross-site scripting in host tab

A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Satellite Satellite Capsule and 2 more
CVE-2023-0118

Foreman: arbitrary code execution through templates

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

CVSS 3.1 · 9.1 Critical EPSS 1.4% KEV · Not listed
Vendors
Redhat Theforeman
Products
Enterprise Linux Satellite Satellite Capsule and 3 more