Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 145

Export CSV
CVE-2021-45046

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS 3.1 · 9 Critical EPSS 100.0% KEV · Listed
Vendors
Apache Cvat Debian and 5 more
Products
Log4j Computer Vision Annotation Tool Debian Linux and 68 more
CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Advanced Cluster Security and 18 more
CVE-2022-25883

nodejs-semver: Regular expression denial of service

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Npmjs Redhat
Products
Semver Acm Enterprise Linux and 7 more
CVE-2024-45801

Tampering by prototype polution in DOMPurify

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Cure53 Redhat
Products
Dompurify Acm Ansible Automation Platform and 5 more
CVE-2021-20190

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to javax.swing

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.1 High EPSS 7.6% KEV · Not listed
Vendors
Apache Debian Fasterxml and 3 more
Products
Nifi Debian Linux Jackson-databind and 8 more
CVE-2023-26136

tough-cookie: prototype pollution in cookie memstore

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

CVSS 3.1 · 6.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat Salesforce
Products
Acm Jboss Enterprise Application Platform Logging and 5 more
CVE-2022-32149

Denial of service via crafted Accept-Language header in golang.org/x/text/language

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Golang Redhat
Products
Text Acm Container Native Virtualization and 7 more
CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Golang Redhat
Products
Go Hpack Http2 and 19 more
CVE-2022-24999

express: "qs" prototype poisoning causes the hang of the node process

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

CVSS 3.1 · 7.5 High EPSS 15.7% KEV · Not listed
Vendors
Debian Openjsf Qs Project and 1 more
Products
Debian Linux Express Qs and 9 more
CVE-2022-21698

Uncontrolled Resource Consumption in promhttp

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

CVSS 3.1 · 7.5 High EPSS 6.0% KEV · Not listed
Vendors
Fedoraproject Prometheus Rdo Project and 1 more
Products
Extra Packages For Enterprise Linux Fedora Client Golang and 14 more
CVE-2021-35065

glob-parent: Regular Expression Denial of Service

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Gulpjs Redhat
Products
Glob-parent Enterprise Linux Logging and 5 more
CVE-2021-38561

golang: out-of-bounds read in golang.org/x/text/language leads to DoS

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Golang Redhat
Products
Text Acm Container Native Virtualization and 3 more
CVE-2021-33631

Kernel crash in EXT4 filesystem

Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openatom Redhat
Products
Openeuler Enterprise Linux Logging and 2 more
CVE-2024-24790

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Golang Redhat
Products
Go Advanced Cluster Security Ansible Automation Platform and 17 more
CVE-2023-39326

Denial of service via chunk extensions in net/http

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Ansible Automation Platform Cryostat and 17 more