Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 113

Export CSV
CVE-2023-24815

Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web

Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource. When computing the relative path to locate the resource, in case of wildcards, the code: `return "/" + rest;` from `Utils.java` returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath. This issue only affects users deploying in windows environments and upgrading is the advised remediation path. There are no known workarounds for this vulnerability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Vert.x-web Camel Spring Boot Cryostat
CVE-2023-1370

Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Json-smart Project Redhat
Products
Json-smart Amq Clients Amq Streams and 6 more
CVE-2021-46877

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Fasterxml Redhat
Products
Jackson-databind Amq Streams Camel Spring Boot and 12 more
CVE-2023-1436

Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArray

An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Jettison Project Redhat
Products
Jettison Camel Quarkus Camel Spring Boot and 6 more
CVE-2023-20861

springframework: Spring Expression DoS Vulnerability

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Vmware
Products
Amq Broker Camel Spring Boot Jboss Enterprise Bpms Platform and 5 more
CVE-2023-20860

springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Redhat Vmware
Products
Amq Broker Camel Spring Boot Jboss Enterprise Bpms Platform and 6 more
CVE-2022-46751

Apache Ivy: XML External Entity vulnerability in Apache Ivy

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used. This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".

CVSS 3.1 · 8.2 High EPSS 2.0% KEV · Not listed
Vendors
Apache Redhat
Products
Ivy Amq Streams Camel Spring Boot and 2 more
CVE-2022-44730

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Xml Graphics Batik Debian Linux Camel Spring Boot and 1 more
CVE-2023-40167

Jetty accepts "+" prefixed value in Content-Length

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Eclipse Redhat
Products
Debian Linux Jetty Amq Broker and 8 more
CVE-2023-34462

netty-handler SniHandler 16MB allocation

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Netty Redhat
Products
Netty Amq Broker Amq Clients and 8 more
CVE-2023-34455

snappy-java's unchecked chunk length leads to DoS

snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk. In the case that the `compressed` variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the `chunkSize` variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal `java.lang.OutOfMemoryError` error. Version 1.1.10.1 contains a patch for this issue.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Redhat Xerial
Products
Amq Broker Amq Streams Camel K and 4 more
CVE-2023-26049

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 2.4 Low EPSS 1.3% KEV · Not listed
Vendors
Debian Eclipse Netapp and 1 more
Products
Debian Linux Jetty Active Iq Unified Manager and 12 more
CVE-2023-26048

OutOfMemoryError for large multipart without filename in Eclipse Jetty

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).

CVSS 3.1 · 5.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Eclipse Redhat
Products
Jetty Amq Streams Camel Spring Boot and 5 more
CVE-2022-41852

JXPath: untrusted XPath expressions may lead to RCE attack

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Camel Spring Boot
CVE-2023-20863

springframework: Spring Expression DoS Vulnerability

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Vmware
Products
Camel Spring Boot Spring Framework
CVE-2023-20883

spring-boot: Spring Boot Welcome Page DoS Vulnerability

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat Vmware
Products
Camel Spring Boot Jboss Enterprise Bpms Platform Jboss Fuse and 2 more
CVE-2023-33201

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Amq Broker Amq Streams and 7 more
CVE-2023-6378

Logback "receiver" DOS vulnerability

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Amq Broker Camel Spring Boot and 2 more
CVE-2023-6481

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Amq Broker Camel Spring Boot and 3 more
CVE-2023-4043

Parsson DoS when parsing numbers from untrusted sources

In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Parsson Camel Quarkus Camel Spring Boot and 3 more