Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 637

Export CSV
CVE-2015-2058

jabberd: buffer overflow when normalizing strings

c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.

CVSS 2.0 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Jabberd2
Products
Jabberd2
CVE-2016-3956

npm: bearer token leak to non-registry hosts

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

CVSS 3.1 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Ibm Nodejs Npmjs
Products
Sdk Node.js Npm
CVE-2015-3237

curl: SMB send off unrelated memory contents

The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.

CVSS 2.0 · 6.4 Medium EPSS 8.3% KEV · Not listed
Vendors
Haxx Hp Oracle
Products
Curl Libcurl System Management Homepage and 2 more
CVE-2015-3236

curl: lingering HTTP credentials in connection re-use

cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
Haxx
Products
Curl Libcurl
CVE-2015-3153

curl: sensitive HTTP server headers also sent to proxies

The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.

CVSS 2.0 · 5.0 Medium EPSS 7.3% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Mac Os X Ubuntu Linux Debian Linux and 3 more
CVE-2014-1591

Mozilla: CSP leaks redirect data via violation reports (MFSA 2014-86)

Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.

CVSS 2.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Mozilla
Products
Firefox Seamonkey
CVE-2014-1829

python-requests: redirect can expose netrc password

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Mageia and 1 more
Products
Ubuntu Linux Debian Linux Mageia and 1 more
CVE-2014-0178

samba: Uninitialized memory exposure

Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.

CVSS 2.0 · 3.5 Low EPSS 4.5% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2014-4721

php: type confusion issue in phpinfo() leading to information leak

The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.

CVSS 2.0 · 2.6 Low EPSS 5.9% KEV · Not listed
Vendors
Debian Php Redhat
Products
Debian Linux Php Enterprise Linux and 1 more
CVE-2015-2296

python-requests: session fixation and cookie stealing vulnerability

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.

CVSS 2.0 · 6.8 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Mageia Project Python
Products
Ubuntu Linux Mageia Requests
CVE-2015-1840

rubygem-jquery-rails: CSRF Vulnerability in jquery-ujs and jquery-rails

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.

CVSS 2.0 · 5.0 Medium EPSS 4.5% KEV · Not listed
Vendors
Fedoraproject Opensuse Rubyonrails
Products
Fedora Opensuse Jquery-rails and 1 more
CVE-2015-5302

libreport: Possible private data leak in Bugzilla bugs opened by ABRT

libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace, (2) cmdline, (3) environ, (4) open_fds, (5) maps, (6) smaps, (7) hostname, (8) remote, (9) ks.cfg, or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libreport
CVE-2014-0040

openstack-heat-templates: use of HTTP to download signing keys/code

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Openstack
CVE-2014-4615

pycadf: token leak to message queue

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Neutron Oslo and 3 more
CVE-2014-3698

pidgin: remote information leak via crafted XMPP message

The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.

CVSS 3.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Pidgin Redhat
Products
Pidgin Enterprise Linux
CVE-2014-3528

subversion: credentials leak via MD5 collision

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

CVSS 2.0 · 4.0 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Apple Canonical and 2 more
Products
Subversion Xcode Ubuntu Linux and 7 more
CVE-2013-7423

glibc: getaddrinfo() writes DNS queries to random file descriptors under high load

The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.

CVSS 2.0 · 5.0 Medium EPSS 5.8% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Glibc Opensuse and 4 more
CVE-2024-39315

Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection between Pomerium and the application is secured by mTLS, or the connection between Pomerium and the application is otherwise secured at the network layer. The issue is patched in Pomerium v0.26.1. No known workarounds are available.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Pomerium
Products
Pomerium