Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 91

Export CSV
CVE-2020-13936

Velocity Sandbox Bypass

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

CVSS 3.1 · 8.8 High EPSS 22.7% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Velocity Engine Wss4j Debian Linux and 19 more
CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 82.8% KEV · Not listed
Vendors
Apache Apple Canonical and 10 more
Products
Traffic Server Mac Os X Swiftnio and 41 more
CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 87.3% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 33 more
CVE-2019-9511

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 59.5% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 26 more
CVE-2024-47561

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.

CVSS 4.0 · 9.2 Critical EPSS 3.3% KEV · Not listed
Vendors
Apache Netapp Redhat
Products
Avro Active Iq Unified Manager Brocade San Navigator and 7 more
CVE-2023-3223

Undertow: outofmemoryerror due to @multipartconfig handling

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Integration Jboss Data Grid and 18 more
CVE-2023-3171

Eap-7: heap exhaustion via deserialization

A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus
CVE-2022-42889

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Not listed
Vendors
Apache Juniper Netapp and 1 more
Products
Commons Text Jsa1500 Jsa3500 and 18 more
CVE-2022-2053

undertow: Large AJP request may cause DoS

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Integration Camel K Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 2 more
CVE-2022-1319

undertow: Double AJP response for 400 from EAP 7 results in CPING failures

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Cloud Secure Agent Oncommand Insight and 8 more
CVE-2022-1259

undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Cloud Secure Agent Oncommand Insight and 9 more
CVE-2022-0084

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Integration Camel K Integration Camel Quarkus Jboss Data Grid and 6 more
CVE-2021-42392

h2: Remote Code Execution in Console

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 83.2% KEV · Not listed
Vendors
Debian H2database Oracle and 1 more
Products
Debian Linux H2 Communications Cloud Native Core Policy and 4 more
CVE-2021-3717

wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 6 more
CVE-2021-3690

undertow: buffer leak on incoming websocket PONG message may lead to DoS

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Enterprise Linux Fuse and 11 more
CVE-2020-7238

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Netty and 1 more
Products
Debian Linux Fedora Netty and 17 more