Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 149

Export CSV
CVE-2020-26237

Prototype Pollution in highlight.js

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

CVSS 3.1 · 5.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Highlightjs Oracle and 1 more
Products
Debian Linux Highlight.js Mysql Enterprise Monitor and 1 more
CVE-2020-15366

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

CVSS 3.1 · 5.6 Medium EPSS 2.3% KEV · Not listed
Vendors
Ajv.js Redhat
Products
Ajv Ansible Automation Platform Enterprise Linux and 3 more
CVE-2020-14313

quay: build triggers can disclose robot account names and existence of private repos within namespaces

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Quay
CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Text 3scale Amp and 13 more
CVE-2020-11538

python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

CVSS 3.1 · 8.1 High EPSS 2.5% KEV · Not listed
Vendors
Canonical Fedoraproject Python and 1 more
Products
Ubuntu Linux Fedora Pillow and 4 more
CVE-2020-10379

python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode()

In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Fedoraproject Python and 1 more
Products
Ubuntu Linux Fedora Pillow and 1 more
CVE-2020-10378

python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files

In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Fedoraproject Python and 1 more
Products
Ubuntu Linux Fedora Pillow and 1 more
CVE-2019-9512

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 83.4% KEV · Not listed
Vendors
Apache Apple Canonical and 3 more
Products
Traffic Server Mac Os X Swiftnio and 21 more
CVE-2019-3867

quay: insufficient session expiration

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Quay
CVE-2019-3866

openstack-mistral: information disclosure in mistral log

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack-mistral Quay
CVE-2019-3865

quay: Stored XSS in super user function

A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Quay
CVE-2019-3864

quay: CSRF token does not expire and is leaked in query string

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Quay
CVE-2019-20922

nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Handlebarsjs Redhat
Products
Handlebars Jboss Enterprise Bpms Platform Openshift and 2 more
CVE-2019-20477

PyYAML: command execution through python/object/apply constructor in FullLoader

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Fedoraproject Pyyaml Redhat
Products
Fedora Pyyaml Enterprise Linux and 1 more
CVE-2019-19911

python-pillow: uncontrolled resource consumption in FpxImagePlugin.py

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2019-16789

HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

CVSS 3.1 · 7.1 High EPSS 2.6% KEV · Not listed
Vendors
Agendaless Debian Fedoraproject and 2 more
Products
Waitress Debian Linux Fedora and 3 more
CVE-2019-16786

HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.

CVSS 3.1 · 7.1 High EPSS 2.4% KEV · Not listed
Vendors
Agendaless Debian Fedoraproject and 2 more
Products
Waitress Debian Linux Fedora and 3 more
CVE-2019-16785

HTTP Request Smuggling: LF vs CRLF handling in Waitress

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.

CVSS 3.1 · 7.1 High EPSS 2.5% KEV · Not listed
Vendors
Agendaless Debian Fedoraproject and 2 more
Products
Waitress Debian Linux Fedora and 3 more