Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425864 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2022-31129

Inefficient Regular Expression Complexity in moment

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

CVSS 3.1 · 7.5 High EPSS 5.6% KEV · Not listed
Vendors
Debian Fedoraproject Momentjs and 1 more
Products
Debian Linux Fedora Moment and 14 more
CVE-2022-24785

Path Traversal in Moment.js

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVSS 3.1 · 7.5 High EPSS 13.8% KEV · Not listed
Vendors
Debian Fedoraproject Momentjs and 3 more
Products
Debian Linux Fedora Moment and 13 more
CVE-2021-43859

Denial of Service by injecting highly recursive collections or maps in XStream

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

CVSS 3.1 · 7.5 High EPSS 7.9% KEV · Not listed
Vendors
Debian Fedoraproject Jenkins and 3 more
Products
Debian Linux Fedora Jenkins and 11 more
CVE-2021-3669

kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Ibm and 2 more
Products
Debian Linux Fedora Spectrum Copy Data Management and 21 more
CVE-2021-23566

Information Exposure

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Nanoid Project Redhat
Products
Nanoid Acm Openshift and 1 more
CVE-2024-56171

libxml2: Use-After-Free in libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
Active Iq Unified Manager H300s H300s Firmware and 25 more
CVE-2024-48910

DOMPurify vulnerable to tampering by prototype polution

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed
Vendors
Cure53 Redhat
Products
Dompurify Advanced Cluster Security Openshift and 1 more
CVE-2024-47875

DOMPurify nesting-based mXSS

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed
Vendors
Cure53 Redhat
Products
Dompurify Enterprise Linux Logging and 3 more
CVE-2024-56326

Jinja has a sandbox breakout through indirect reference to format method

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Palletsprojects Redhat
Products
Jinja Ansible Automation Platform Discovery and 12 more
CVE-2024-43799

send vulnerable to template injection that can lead to XSS

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Send Project
Products
Discovery Network Observ Optr Openshift and 8 more
CVE-2021-3979

ceph: Ceph volume does not honour osd_dmcrypt_key_size

A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ceph Storage Ceph Storage For Ibm Z Systems and 5 more
CVE-2023-41080

Apache Tomcat: Open redirect with FORM authentication

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

CVSS 3.1 · 6.1 Medium EPSS 6.5% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Tomcat Debian Linux Amq Broker and 4 more
CVE-2023-45648

Apache Tomcat: Trailer header parsing too lenient

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

CVSS 3.1 · 5.3 Medium EPSS 5.9% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Tomcat Debian Linux Enterprise Linux and 3 more
CVE-2023-47108

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Opentelemetry Redhat
Products
Opentelemetry Acm Multicluster Engine and 3 more
CVE-2019-0211

httpd: privilege escalation from modules scripts

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CVSS 3.1 · 7.8 High EPSS 65.0% KEV · Listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 25 more
CVE-2021-45046

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS 3.1 · 9 Critical EPSS 100.0% KEV · Listed
Vendors
Apache Cvat Debian and 5 more
Products
Log4j Computer Vision Annotation Tool Debian Linux and 68 more
CVE-2019-1003030

jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

CVSS 3.1 · 9.9 Critical EPSS 97.1% KEV · Listed
Vendors
Jenkins Redhat
Products
Pipeline\ Openshift Openshift Container Platform
CVE-2019-1003029

jenkins-plugin-script-security: sandbox bypass in script security plugin

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.

CVSS 3.1 · 9.9 Critical EPSS 74.4% KEV · Listed
Vendors
Jenkins Redhat
Products
Script Security Openshift Openshift Container Platform