Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 276

Export CSV
CVE-2015-7501

apache-commons-collections: InvokerTransformer code execution during deserialisation

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

CVSS 3.0 · 9.8 Critical EPSS 85.6% KEV · Not listed
Vendors
Redhat
Products
Data Grid Enterprise Linux Jboss A-mq and 19 more
CVE-2016-6816

tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

CVSS 3.0 · 7.1 High EPSS 39.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Enterprise Application Platform and 1 more
CVE-2016-8610

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVSS 3.1 · 7.5 High EPSS 39.9% KEV · Not listed
Vendors
Debian Fujitsu Netapp and 4 more
Products
Debian Linux M10-1 M10-1 Firmware and 52 more
CVE-2016-8745

tomcat: information disclosure due to incorrect Processor sharing

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

CVSS 3.0 · 7.5 High EPSS 16.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Enterprise Web Server
CVE-2017-12613

apr: Out-of-bounds array deref in apr_time_exp*() functions

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

CVSS 3.1 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Portable Runtime Debian Linux Enterprise Linux and 14 more
CVE-2017-9788

httpd: Uninitialized memory reflection in mod_auth_digest

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.

CVSS 3.0 · 9.1 Critical EPSS 56.8% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Debian Linux and 15 more
CVE-2015-8035

libxml2: DoS caused by incorrect error detection during XZ decompression

The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.

CVSS 2.0 · 2.6 Low EPSS 3.3% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Iphone Os Mac Os X Tvos and 7 more
CVE-2015-7942

libxml2: heap-based buffer overflow in xmlParseConditionalSections()

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

CVSS 2.0 · 6.8 Medium EPSS 4.5% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 8 more
CVE-2014-3506

openssl: DTLS memory exhaustion

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

CVSS 2.0 · 5.0 Medium EPSS 46.1% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more
CVE-2014-3505

openssl: DTLS packet processing double free

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

CVSS 2.0 · 5.0 Medium EPSS 46.1% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Enterprise Application Platform and 2 more
CVE-2016-0800

SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

CVSS 3.0 · 5.9 Medium EPSS 82.1% KEV · Not listed
Vendors
Openssl Pulsesecure Redhat
Products
Openssl Client Steel Belted Radius and 8 more
CVE-2016-1240

tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

CVSS 3.0 · 7.8 High EPSS 9.8% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 1 more
CVE-2016-2105

openssl: EVP_EncodeUpdate overflow

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.

CVSS 3.1 · 7.5 High EPSS 39.6% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Ubuntu Linux Debian Linux and 17 more
CVE-2016-2106

openssl: EVP_EncryptUpdate overflow

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

CVSS 3.0 · 7.5 High EPSS 27.3% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2014-0226

httpd: mod_status heap-based buffer overflow

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

CVSS 2.0 · 6.8 Medium EPSS 85.8% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Http Server Debian Linux Enterprise Manager Ops Center and 6 more
CVE-2014-0224

openssl: SSL/TLS MITM vulnerability

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS 3.1 · 7.4 High EPSS 95.3% KEV · Not listed
Vendors
Fedoraproject Filezilla-project Mariadb and 6 more
Products
Fedora Filezilla Server Mariadb and 20 more
CVE-2014-0221

openssl: DoS when sending invalid DTLS handshake

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

CVSS 2.0 · 4.3 Medium EPSS 87.9% KEV · Not listed
Vendors
Fedoraproject Mariadb Openssl and 3 more
Products
Fedora Mariadb Openssl and 10 more
CVE-2016-5387

HTTPD: sets environmental variable based on user supplied Proxy request header

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.1 · 8.1 High EPSS 55.7% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 19 more