Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 101

Export CSV
CVE-2022-31690

spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Vmware
Products
Active Iq Unified Manager Migration Toolkit Applications Migration Toolkit Runtimes and 2 more
CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Golang Redhat
Products
Go Hpack Http2 and 19 more
CVE-2024-29131

Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

CVSS 3.1 · 7.3 High EPSS 2.1% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Commons Configuration Fedora Ontap Tools and 4 more
CVE-2024-29133

Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Commons Configuration Fedora Amq Broker and 2 more
CVE-2022-24999

express: "qs" prototype poisoning causes the hang of the node process

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

CVSS 3.1 · 7.5 High EPSS 15.7% KEV · Not listed
Vendors
Debian Openjsf Qs Project and 1 more
Products
Debian Linux Express Qs and 9 more
CVE-2022-36033

jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled

jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Jsoup Netapp Redhat
Products
Jsoup Management Services For Element Software Management Services For Netapp Hci and 3 more
CVE-2022-45693

jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Debian Jettison Project Redhat
Products
Debian Linux Jettison Camel Spring Boot and 7 more
CVE-2022-46364

Apache CXF SSRF Vulnerability

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Camel Spring Boot Jboss Enterprise Application Platform and 7 more
CVE-2021-35065

glob-parent: Regular Expression Denial of Service

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Gulpjs Redhat
Products
Glob-parent Enterprise Linux Logging and 5 more
CVE-2022-3782

keycloak: path traversal via double URL encoding

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

CVSS 3.1 · 9.1 Critical EPSS 6.2% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Jboss Enterprise Bpms Platform Keycloak and 5 more
CVE-2022-41721

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Golang Redhat
Products
H2c Acm Migration Toolkit Applications and 2 more
CVE-2024-26308

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Redhat
Products
Commons Compress Amq Broker Camel Quarkus and 6 more
CVE-2022-4492

undertow: Server identity in https connection is not checked by the undertow client

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Camel Spring Boot Integration Camel For Spring Boot and 14 more
CVE-2022-41725

Excessive resource consumption in mime/multipart

A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Ansible Automation Platform Cert Manager and 16 more
CVE-2022-41724

Panic on large handshake records in crypto/tls

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Golang Redhat
Products
Go Ansible Automation Platform Cert Manager and 17 more
CVE-2021-46877

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Fasterxml Redhat
Products
Jackson-databind Amq Streams Camel Spring Boot and 12 more
CVE-2023-1436

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Jettison Project Redhat
Products
Jettison Camel Quarkus Camel Spring Boot and 6 more