Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 212

Export CSV
CVE-2021-3629

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 11 more
CVE-2021-3597

undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

CVSS 3.1 · 5.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 9 more
CVE-2021-38153

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

CVSS 3.1 · 5.9 Medium EPSS 6.2% KEV · Not listed
Vendors
Apache Oracle Quarkus and 1 more
Products
Kafka Communications Brm - Elastic Charging Engine Communications Cloud Native Core Policy and 12 more
CVE-2021-2471

mysql-connector-java: unauthorized access to critical

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

CVSS 3.1 · 5.9 Medium EPSS 7.5% KEV · Not listed
Vendors
Oracle Quarkus Redhat
Products
Communications Cloud Native Core Console Communications Cloud Native Core Network Slice Selection Function Communications Cloud Native Core Policy and 8 more
CVE-2021-26291

block repositories using http by default

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

CVSS 3.1 · 9.1 Critical EPSS 8.7% KEV · Not listed
Vendors
Apache Oracle Quarkus and 1 more
Products
Maven Financial Services Analytical Applications Infrastructure Goldengate Big Data And Application Adapters and 6 more
CVE-2021-20289

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Netapp Oracle Quarkus and 1 more
Products
Oncommand Insight Communications Cloud Native Core Console Quarkus and 9 more
CVE-2021-20218

fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

CVSS 3.1 · 7.4 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
A-mq Online Amq Online Build Of Quarkus and 13 more
CVE-2020-7238

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Netty and 1 more
Products
Debian Linux Fedora Netty and 17 more
CVE-2020-27822

wildfly: Potential Memory leak in Wildfly when using OpenTracing

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jbosseapxp Openshift Application Runtimes and 2 more
CVE-2020-27782

undertow: special character in query results in server errors

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Integration Jboss Enterprise Application Platform and 5 more
CVE-2020-26238

Critical vulnerability found in cron-utils

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

CVSS 3.1 · 7.9 High EPSS 4.2% KEV · Not listed
Vendors
Cron-utils Project Redhat
Products
Cron-utils Camel Quarkus Integration and 1 more
CVE-2020-25724

resteasy: information disclosure via HTTP response reuse

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Openshift Application Runtimes Resteasy
CVE-2020-25689

wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Service Level Manager and 8 more
CVE-2020-25644

wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Oncommand Workflow Automation Service Level Manager and 9 more
CVE-2020-25633

resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2020-1757

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 5 more