Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 68

Export CSV
CVE-2019-12423

cxf: OpenId Connect token service does not properly validate the clientId

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.

CVSS 3.1 · 7.5 High EPSS 6.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Cxf Commerce Guided Search Communications Diameter Signaling Router and 11 more
CVE-2019-12402

apache-commons-compress: Infinite loop in name encoding algorithm

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

CVSS 3.1 · 7.5 High EPSS 16.2% KEV · Not listed
Vendors
Apache Fedoraproject Oracle and 1 more
Products
Commons Compress Fedora Banking Payments and 17 more
CVE-2019-11358

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVSS 3.1 · 6.1 Medium EPSS 86.8% KEV · Not listed
Vendors
Backdropcms Debian Drupal and 8 more
Products
Backdrop Debian Linux Drupal and 111 more
CVE-2019-10247

jetty: error path information disclosure

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

CVSS 3.1 · 5.3 Medium EPSS 5.9% KEV · Not listed
Vendors
Debian Eclipse Netapp and 2 more
Products
Debian Linux Jetty Element and 25 more
CVE-2019-10246

jetty: Directory Listing on Windows reveals Resource Base path

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

CVSS 3.1 · 5.3 Medium EPSS 4.1% KEV · Not listed
Vendors
Eclipse Microsoft Netapp and 1 more
Products
Jetty Windows Element and 23 more
CVE-2019-10097

httpd: null-pointer dereference in mod_remoteip

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CVSS 3.1 · 7.2 High EPSS 52.9% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Http Server Communications Element Manager Communications Session Report Manager and 8 more
CVE-2019-10092

httpd: limited cross-site scripting in mod_proxy error page

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

CVSS 3.1 · 6.1 Medium EPSS 81.5% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 10 more