Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2022-23305

SQL injection in JDBC Appender in Apache Log4j V1

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS 3.1 · 9.8 Critical EPSS 66.5% KEV · Not listed
Vendors
Apache Broadcom Netapp and 3 more
Products
Log4j Brocade Sannav Snapmanager and 43 more
CVE-2022-23307

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

CVSS 3.1 · 8.8 High EPSS 54.4% KEV · Not listed
Vendors
Apache Oracle Qos and 1 more
Products
Chainsaw Log4j Advanced Supply Chain Planning and 41 more
CVE-2007-4559

python: tarfile module directory traversal

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Rhel Eus and 1 more
CVE-2016-0752

rubygem-actionpack: directory traversal flaw in Action View

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

CVSS 3.1 · 7.5 High EPSS 95.5% KEV · Listed
Vendors
Debian Opensuse Redhat and 2 more
Products
Debian Linux Leap Opensuse and 4 more
CVE-2014-0130

rubygem-actionpack: directory traversal issue

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

CVSS 3.1 · 7.5 High EPSS 53.7% KEV · Listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Cloudforms Managementengine Enterprise Linux Server Rhel Software Collections and 3 more
CVE-2017-7407

curl: --write-out out of bounds read

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2017-1000101

curl: URL globbing out of bounds read

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2017-1000100

curl: TFTP sends more than buffer size

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

CVSS 3.1 · 6.5 Medium EPSS 4.0% KEV · Not listed
Vendors
Haxx Redhat
Products
Libcurl Rhel Software Collections
CVE-2016-8624

curl: Invalid URL parsing with '#'

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

CVSS 3.0 · 5.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8615

curl: Cookie injection for other servers

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.

CVSS 3.0 · 5.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8617

curl: Out-of-bounds write via unchecked multiplication

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2018-1000301

curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVSS 3.1 · 9.1 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Debian Haxx and 2 more
Products
Ubuntu Linux Debian Linux Curl and 12 more
CVE-2017-8817

curl: FTP wildcard out of bounds read

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

CVSS 3.1 · 9.8 Critical EPSS 11.2% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Curl Libcurl and 1 more
CVE-2017-8816

curl: NTLM buffer overflow via integer overflow

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.

CVSS 3.1 · 9.8 Critical EPSS 8.5% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Curl Libcurl and 1 more
CVE-2017-1000257

curl: IMAP FETCH response out of bounds read

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

CVSS 3.1 · 9.1 Critical EPSS 6.2% KEV · Not listed
Vendors
Debian Haxx Redhat
Products
Debian Linux Libcurl Enterprise Linux and 2 more
CVE-2016-8620

curl: Glob parser write/read out of bounds

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2016-9586

curl: printf floating point buffer overflow

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

CVSS 3.0 · 5.9 Medium EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Rhel Software Collections
CVE-2016-8622

curl: URL unescape heap overflow via integer truncation

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.

CVSS 3.0 · 3.7 Low EPSS 4.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Libcurl Jboss Core Services Rhel Software Collections