Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2020-17518

Apache Flink directory traversal attack: remote file writing through the REST API

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

CVSS 3.1 · 7.5 High EPSS 49.4% KEV · Not listed
Vendors
Apache Redhat
Products
Flink Camel Quarkus Integration and 1 more
CVE-2020-13954

Apache CXF Reflected XSS in the services listing page via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.

CVSS 3.1 · 6.1 Medium EPSS 40.9% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Cxf Snap Creator Framework Vasa Provider For Clustered Data Ontap and 5 more
CVE-2020-13936

Velocity Sandbox Bypass

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

CVSS 3.1 · 8.8 High EPSS 22.7% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Velocity Engine Wss4j Debian Linux and 19 more
CVE-2019-0231

Apache MINA SSLFilter security Issue

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Apache Redhat
Products
Mina Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform and 3 more
CVE-2023-20883

spring-boot: Spring Boot Welcome Page DoS Vulnerability

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat Vmware
Products
Camel Spring Boot Jboss Enterprise Bpms Platform Jboss Fuse and 2 more
CVE-2019-9518

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.

CVSS 3.1 · 7.5 High EPSS 25.4% KEV · Not listed
Vendors
Apache Apple Canonical and 8 more
Products
Traffic Server Mac Os X Swiftnio and 23 more
CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 87.3% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 33 more
CVE-2019-9516

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

CVSS 3.1 · 6.5 Medium EPSS 57.5% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 21 more
CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 82.8% KEV · Not listed
Vendors
Apache Apple Canonical and 10 more
Products
Traffic Server Mac Os X Swiftnio and 41 more
CVE-2019-9513

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

CVSS 3.1 · 7.5 High EPSS 81.6% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 22 more
CVE-2019-9511

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 59.5% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 26 more
CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 27.0% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Http Server Traffic Server Mac Os X and 25 more
CVE-2023-33201

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Amq Broker Amq Streams and 7 more
CVE-2023-6378

Logback "receiver" DOS vulnerability

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Amq Broker Camel Spring Boot and 2 more
CVE-2023-6481

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Amq Broker Camel Spring Boot and 3 more
CVE-2023-3635

Okio GzipSource unhandled exception Denial of Service

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat Squareup
Products
Amq Streams Jboss Enterprise Bpms Platform Jboss Fuse and 3 more
CVE-2023-3223

Undertow: outofmemoryerror due to @multipartconfig handling

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Integration Jboss Data Grid and 18 more
CVE-2023-34034

spring-security-webflux: path wildcard leads to security bypass

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

CVSS 3.1 · 9.1 Critical EPSS 4.1% KEV · Not listed
Vendors
Redhat Vmware
Products
Jboss Fuse Spring Security
CVE-2023-22602

Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Apache Redhat Vmware
Products
Shiro Camel Spring Boot Jboss Fuse and 1 more