Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 630

Export CSV
CVE-2022-42889

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Not listed
Vendors
Apache Juniper Netapp and 1 more
Products
Commons Text Jsa1500 Jsa3500 and 18 more
CVE-2022-3874

Os command injection via ct_command and fcct_command

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.

CVSS 3.1 · 8 High EPSS 2.2% KEV · Not listed
Vendors
Redhat Theforeman
Products
Satellite Satellite Capsule Satellite Utils and 1 more
CVE-2022-38749

DoS in SnakeYAML

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Redhat Snakeyaml Project
Products
Debian Linux Amq Broker Amq Clients and 8 more
CVE-2022-33980

Apache Commons Configuration insecure interpolation defaults

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.

CVSS 3.1 · 9.8 Critical EPSS 44.6% KEV · Not listed
Vendors
Apache Debian Netapp and 1 more
Products
Commons Configuration Debian Linux Snapcenter and 3 more
CVE-2022-31163

TZInfo relative path traversal vulnerability allows loading of arbitrary files

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Debian Redhat Tzinfo Project
Products
Debian Linux Satellite Storage and 1 more
CVE-2022-30122

rubygem-rack: crafted multipart POST request may cause a DoS

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Debian Rack Project Redhat
Products
Debian Linux Rack Satellite and 2 more
CVE-2022-27777

tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Redhat Rubyonrails
Products
Debian Linux Satellite Actionpack
CVE-2022-25648

Command Injection

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

CVSS 3.1 · 8.1 High EPSS 4.6% KEV · Not listed
Vendors
Debian Fedoraproject Git and 1 more
Products
Debian Linux Extra Packages For Enterprise Linux Fedora and 2 more
CVE-2022-24836

Inefficient Regular Expression Complexity in Nokogiri

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Macos Debian Linux Fedora and 3 more
CVE-2022-23837

sidekiq: WebUI Denial of Service caused by number of days on graph

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.

CVSS 3.1 · 7.5 High EPSS 5.2% KEV · Not listed
Vendors
Contribsys Debian Redhat
Products
Sidekiq Debian Linux Satellite
CVE-2022-23833

django: Denial-of-service possibility in file uploads

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

CVSS 3.1 · 7.5 High EPSS 49.5% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 3 more
CVE-2022-23633

Exposure of sensitive information in Action Pack

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

CVSS 3.1 · 7.4 High EPSS 2.2% KEV · Not listed
Vendors
Debian Redhat Rubyonrails
Products
Debian Linux Satellite Rails
CVE-2022-22818

django: Possible XSS via '{% debug %}' template tag

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

CVSS 3.1 · 6.1 Medium EPSS 3.4% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 3 more
CVE-2022-0759

kubeclient: kubeconfig parsing error can lead to MITM attacks

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Kubeclient Logging Satellite
CVE-2021-4142

Satellite: Allow unintended SCA certificate to authenticate Candlepin

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Candlepinproject Redhat
Products
Candlepin Satellite Satellite Capsule and 1 more
CVE-2021-45452

django: Potential directory-traversal via Storage.save()

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Satellite and 1 more