Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 66

Export CSV
CVE-2021-43565

golang.org/x/crypto: empty plaintext packet causes panic

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Golang Redhat
Products
Ssh Acm Advanced Cluster Security and 6 more
CVE-2021-3703

serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196

It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless client kn 1.16.0. These have been fixed with Serverless 1.17.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Serverless Serverless
CVE-2024-43800

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Serve-static Discovery Network Observ Optr and 8 more
CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Express Discovery Network Observ Optr and 8 more
CVE-2024-8391

Eclipse Vert.x gRPC server does not limit the maximum message size

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).  This is fixed in the 4.5.10 version.  Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Eclipse Foundation Redhat
Products
Vert.x Vert.x Camel Quarkus and 3 more
CVE-2024-39338

axios: axios: Server-Side Request Forgery

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVSS 3.1 · 4 Medium EPSS 1.2% KEV · Not listed
Vendors
Axios Redhat
Products
Axios Discovery Network Observ Optr and 5 more