Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2022-21363

mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 6.6 Medium EPSS 1.5% KEV · Not listed
Vendors
Oracle Quarkus Redhat
Products
Mysql Connectors Quarkus Jboss Enterprise Application Platform and 3 more
CVE-2022-1415

Drools: unsafe data deserialization in streamutils

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

CVSS 3.1 · 8.1 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Camel Spring Boot Decision Manager and 13 more
CVE-2022-1319

undertow: Double AJP response for 400 from EAP 7 results in CPING failures

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Cloud Secure Agent Oncommand Insight and 8 more
CVE-2022-1259

undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Cloud Secure Agent Oncommand Insight and 9 more
CVE-2022-0084

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Integration Camel K Integration Camel Quarkus Jboss Data Grid and 6 more
CVE-2021-4178

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
A-mq Streams Amq Streams Build Of Quarkus and 10 more
CVE-2021-42550

RCE from attacker with configuration edit priviledges through JNDI lookup

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS 3.1 · 6.6 Medium EPSS 4.8% KEV · Not listed
Vendors
Netapp Qos Redhat and 1 more
Products
Cloud Manager Service Level Manager Snap Creator Framework and 6 more
CVE-2021-42340

DoS via memory leak with WebSocket connections

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

CVSS 3.1 · 7.5 High EPSS 11.8% KEV · Not listed
Vendors
Apache Debian Netapp and 2 more
Products
Tomcat Debian Linux Hci and 19 more
CVE-2021-41766

Insecure Java Deserialization in Apache Karaf

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).

CVSS 3.1 · 8.1 High EPSS 2.0% KEV · Not listed
Vendors
Apache Redhat
Products
Karaf Jboss Fuse
CVE-2021-3717

wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 6 more
CVE-2021-3690

undertow: buffer leak on incoming websocket PONG message may lead to DoS

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Enterprise Linux Fuse and 11 more
CVE-2021-3644

wildfly-core: Invalid Sensitivity Classification of Vault Expression

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

CVSS 3.1 · 3.3 Low EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Descision Manager Jboss Enterprise Application Platform Jboss Enterprise Bpms Platform and 4 more
CVE-2021-3642

wildfly-elytron: possible timing attack in ScramServer

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Build Of Quarkus Camel Quarkus and 15 more
CVE-2021-3629

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 11 more
CVE-2021-3597

undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

CVSS 3.1 · 5.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 9 more
CVE-2021-3536

wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Data Grid Descision Manager and 9 more
CVE-2021-38153

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

CVSS 3.1 · 5.9 Medium EPSS 6.2% KEV · Not listed
Vendors
Apache Oracle Quarkus and 1 more
Products
Kafka Communications Brm - Elastic Charging Engine Communications Cloud Native Core Policy and 12 more
CVE-2021-35516

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

CVSS 3.1 · 7.5 High EPSS 12.4% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Commons Compress Active Iq Unified Manager Oncommand Insight and 23 more