Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2018-3831

elasticsearch: Information exposure via _cluster/settings API

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Elastic Redhat
Products
Elasticsearch Jboss Fuse
CVE-2018-3258

mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.0 · 8.8 High EPSS 3.7% KEV · Not listed
Vendors
Oracle Redhat
Products
Connector\/j Jboss Fuse Satellite and 1 more
CVE-2018-1339

tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tika Jboss Fuse
CVE-2018-1338

tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tika Jboss Fuse
CVE-2018-1336

tomcat: A bug in the UTF-8 decoder can lead to DoS

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

CVSS 3.1 · 7.5 High EPSS 20.4% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 9 more
CVE-2018-1320

thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

CVSS 3.1 · 7.5 High EPSS 8.2% KEV · Not listed
Vendors
Apache Debian F5 and 2 more
Products
Thrift Debian Linux Traffix Signaling Delivery Controller and 3 more
CVE-2018-1295

ignite: Possible Execution of Arbitrary Code Within Deserialization Endpoints

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.

CVSS 3.0 · 9.8 Critical EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Ignite Jboss Fuse
CVE-2018-1288

kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

CVSS 3.1 · 5.4 Medium EPSS 4.8% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Kafka Database Primavera P6 Enterprise Project Portfolio Management and 3 more
CVE-2018-1275

spring-framework: Address partial fix for CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.

CVSS 3.1 · 9.8 Critical EPSS 57.7% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Application Testing Suite Big Data Discovery Communications Converged Application Server and 18 more
CVE-2018-1272

spring-framework: Multipart content pollution

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Application Testing Suite Big Data Discovery Communications Converged Application Server and 24 more
CVE-2018-1271

spring-framework: Directory traversal vulnerability with static resources on Windows filesystems

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

CVSS 3.1 · 5.9 Medium EPSS 30.3% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Application Testing Suite Big Data Discovery Communications Converged Application Server and 27 more
CVE-2018-1260

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Security Oauth Jboss Fuse Openshift Application Runtimes
CVE-2018-1199

spring-framework: Improper URL path validation allows for bypassing of security checks on static resources

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Rapid Planning Retail Xstore Point Of Service Fuse and 3 more
CVE-2018-1131

infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid Jboss Fuse
CVE-2018-1114

undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2018-15758

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

CVSS 3.0 · 9.6 Critical EPSS 2.2% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Security Oauth Jboss Fuse
CVE-2018-12541

vertx: WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x Jboss Fuse Openshift Application Runtimes
CVE-2018-12537

vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x Jboss Fuse Openshift Application Runtimes
CVE-2018-12536

jetty: full server path revealed when using the default Error Handling

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

CVSS 3.1 · 5.3 Medium EPSS 4.2% KEV · Not listed
Vendors
Eclipse Oracle Redhat
Products
Jetty Retail Xstore Point Of Service Jboss Fuse
CVE-2018-11798

thrift: Improper Access Control grants access to files outside the webservers docroot path

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Apache Redhat
Products
Thrift Jboss Data Virtualization Jboss Fuse