Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 329

Export CSV
CVE-2024-7246

HPACK table poisoning in gRPC C++, Python & Ruby

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent (incrementally indexed) added headers in the first request being poisoned until cleared from the HPACK table. Please update to a fixed version of gRPC as soon as possible. This bug has been fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grpc Redhat
Products
Grpc Ansible Automation Platform Rhui and 2 more
CVE-2024-31755

cjson: segmentation violation trigger through the second parameter of function cJSON_SetValuestring at cJSON.c

cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Cjson Project Redhat
Products
Cjson Satellite Satellite Capsule
CVE-2023-28366

mosquitto: memory leak leads to unresponsive broker

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Eclipse Redhat
Products
Mosquitto Satellite Satellite Capsule
CVE-2023-36479

Jetty vulnerable to errant command quoting in CGI Servlet

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

CVSS 3.1 · 3.5 Low EPSS 1.2% KEV · Not listed
Vendors
Debian Eclipse Redhat
Products
Debian Linux Jetty Jboss Fuse and 4 more
CVE-2025-46727

Unbounded-Parameter DoS in Rack::QueryParser

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Rack Redhat
Products
Rack Enterprise Linux Rhel E4s and 4 more
CVE-2022-29181

Improper Handling of Unexpected Data Type in Nokogiri

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.

CVSS 3.1 · 8.2 High EPSS 3.2% KEV · Not listed
Vendors
Apple Nokogiri Redhat
Products
Macos Nokogiri Satellite and 1 more
CVE-2021-45116

django: Potential information disclosure in dictsort template filter

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Satellite and 1 more
CVE-2022-41323

python-django: Potential denial-of-service vulnerability in internationalized URLs

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Djangoproject Redhat
Products
Django Rhui Satellite and 1 more
CVE-2018-5382

Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Satellite Satellite Capsule
CVE-2016-1000342

bouncycastle: ECDSA improper validation of ASN.1 encoding of signature

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

CVSS 3.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000343

bouncycastle: DSA key pair generator generates a weak private key by default

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000352

bouncycastle: ECIES implementation allowed the use of ECB mode

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

CVSS 3.0 · 7.4 High EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2016-1000346

bouncycastle: Other party DH public keys are not fully validated

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

CVSS 3.0 · 3.7 Low EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000341

bouncycastle: Information exposure in DSA signature generation via timing attack

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

CVSS 3.0 · 5.9 Medium EPSS 2.5% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000344

bouncycastle: DHIES implementation allowed the use of ECB mode

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

CVSS 3.0 · 7.4 High EPSS 2.1% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2016-1000340

bouncycastle: Carry propagation bug in math.raw.Nat??? class

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Bouncycastle Redhat
Products
Bc-java Jboss Fuse Satellite and 1 more
CVE-2016-1000339

bouncycastle: Information leak in AESFastEngine class

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.

CVSS 3.0 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more
CVE-2016-1000345

bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

CVSS 3.0 · 5.9 Medium EPSS 2.6% KEV · Not listed
Vendors
Bouncycastle Debian Redhat
Products
Bc-java Debian Linux Jboss Fuse and 2 more