Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 238

Export CSV
CVE-2023-4065

Operator: plaintext password in operator log

A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Enterprise Linux Jboss A-mq and 3 more
CVE-2023-2976

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Guava Amq Broker Amq Streams and 7 more
CVE-2024-8285

Kroxylicious: missing upstream kafka tls hostname verification

A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Streams Kroxylicious
CVE-2023-4066

Operator: passwords defined in secrets shown in statefulset yaml

A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Enterprise Linux Jboss A-mq and 3 more
CVE-2019-10768

AngularJS: Prototype pollution in merge function could result in code injection

In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Angularjs Redhat
Products
Angularjs Amq Broker Jboss Fuse and 1 more
CVE-2020-7676

nodejs-angular: XSS due to regex-based HTML replacement

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.

CVSS 3.1 · 5.4 Medium EPSS 1.9% KEV · Not listed
Vendors
Angularjs Redhat
Products
Angularjs Amq Broker Ansible Tower and 2 more
CVE-2020-11023

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 84.9% KEV · Listed
Vendors
Debian Drupal Fedoraproject and 5 more
Products
Debian Linux Drupal Fedora and 75 more
CVE-2024-25710

Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apache Redhat
Products
Commons Compress Amq Broker Amq Streams and 7 more
CVE-2023-46604

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVSS 3.1 · 10 Critical EPSS 100.0% KEV · Listed
Vendors
Apache Debian Netapp and 1 more
Products
Activemq Activemq Legacy Openwire Module Debian Linux and 7 more
CVE-2022-41678

Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

CVSS 3.1 · 8.8 High EPSS 85.7% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Amq Broker Jboss Fuse and 1 more
CVE-2024-9823

Jetty DOS vulnerability on DosFilter

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Netapp Redhat
Products
Jetty Active Iq Unified Manager Bootstrap Os and 2 more
CVE-2024-8184

Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

CVSS 3.1 · 5.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Eclipse Redhat
Products
Jetty Amq Streams Rhboac Hawtio
CVE-2022-22965

spring-framework: RCE via Data Binding on JDK 9+

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CVSS 3.1 · 9.8 Critical EPSS 99.6% KEV · Listed
Vendors
Cisco Oracle Redhat and 3 more
Products
Cx Cloud Agent Commerce Platform Communications Cloud Native Core Automated Test Suite and 42 more
CVE-2023-41080

Apache Tomcat: Open redirect with FORM authentication

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

CVSS 3.1 · 6.1 Medium EPSS 6.5% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Tomcat Debian Linux Amq Broker and 4 more
CVE-2021-45046

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS 3.1 · 9 Critical EPSS 100.0% KEV · Listed
Vendors
Apache Cvat Debian and 5 more
Products
Log4j Computer Vision Annotation Tool Debian Linux and 68 more
CVE-2024-7254

Stack overflow in Protocol Buffers Java Lite

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

CVSS 4.0 · 8.7 High EPSS 2.8% KEV · Not listed
Vendors
Google Netapp Redhat
Products
Google-protobuf Protobuf Protobuf-java and 12 more
CVE-2023-5072

DoS Vulnerability in JSON-Java

Denial of Service in JSON-Java versions up to and including 20230618.  A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being used.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat Stleary
Products
Amq Broker Amq Streams Camel K and 5 more
CVE-2024-29025

Netty HttpPostRequestDecoder can OOM

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Netty Redhat
Products
Debian Linux Netty Amq Broker and 10 more