Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,903

Export CSV
CVE-2019-16168

sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

CVSS 3.1 · 6.5 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2021-44533

nodejs: Incorrect handling of certificate subject and issuer fields

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

CVSS 3.1 · 5.3 Medium EPSS 9.4% KEV · Not listed
Vendors
Debian Nodejs Oracle and 1 more
Products
Debian Linux Node.js Graalvm and 11 more
CVE-2021-3449

NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

CVSS 3.1 · 5.9 Medium EPSS 63.5% KEV · Not listed
Vendors
Checkpoint Debian Fedoraproject and 10 more
Products
Multi-domain Management Multi-domain Management Firmware Quantum Security Gateway and 169 more
CVE-2021-33037

Incorrect Transfer-Encoding handling with HTTP/1.0

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

CVSS 3.1 · 5.3 Medium EPSS 74.7% KEV · Not listed
Vendors
Apache Debian Mcafee and 2 more
Products
Tomcat Tomee Debian Linux and 22 more
CVE-2021-25122

Apache Tomcat h2c request mix-up

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

CVSS 3.1 · 7.5 High EPSS 18.1% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Tomcat Debian Linux Agile Product Lifecycle Management and 12 more
CVE-2020-5398

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

CVSS 3.1 · 7.5 High EPSS 88.3% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Data Availability Services Snapcenter Application Testing Suite and 31 more
CVE-2020-5258

Prototype pollution in dojo

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

CVSS 3.1 · 7.7 High EPSS 4.0% KEV · Not listed
Vendors
Debian Linuxfoundation Oracle
Products
Debian Linux Dojo Communications Application Session Controller and 7 more
CVE-2020-17527

Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

CVSS 3.1 · 7.5 High EPSS 24.6% KEV · Not listed
Vendors
Apache Debian Netapp and 2 more
Products
Tomcat Debian Linux Element Plug-in and 12 more
CVE-2020-13934

tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 64.1% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Tomcat Ubuntu Linux Debian Linux and 14 more
CVE-2020-11996

tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

CVSS 3.1 · 7.5 High EPSS 26.7% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Tomcat Ubuntu Linux Debian Linux and 8 more
CVE-2019-1551

rsaz_512_sqr overflow bug on x86_64

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

CVSS 3.1 · 5.3 Medium EPSS 14.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2019-10219

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Element Management Services For Element Software And Netapp Hci and 195 more
CVE-2018-5407

openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVSS 3.1 · 4.7 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Nodejs and 4 more
Products
Ubuntu Linux Debian Linux Node.js and 20 more
CVE-2018-15756

DoS Attack via Range Requests

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

CVSS 3.1 · 7.5 High EPSS 8.8% KEV · Not listed
Vendors
Debian Oracle Redhat and 1 more
Products
Debian Linux Agile Product Lifecycle Management Communications Brm - Elastic Charging Engine and 39 more
CVE-2018-11040

springframework: cross-domain requests via JSONP through AbstractJsonpResponseBodyAdvice

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Oracle Vmware
Products
Debian Linux Agile Product Lifecycle Management Application Testing Suite and 25 more
CVE-2018-11039

springframework: Cross Site Tracing (XST) if vulnerable to XSS

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

CVSS 3.1 · 5.9 Medium EPSS 2.8% KEV · Not listed
Vendors
Debian Oracle Vmware
Products
Debian Linux Agile Product Lifecycle Management Application Testing Suite and 30 more
CVE-2018-0735

Timing attack against ECDSA signature generation

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

CVSS 3.1 · 5.9 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Netapp and 4 more
Products
Ubuntu Linux Debian Linux Cloud Backup and 21 more
CVE-2018-0734

Timing attack against DSA

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

CVSS 3.1 · 5.9 Medium EPSS 12.2% KEV · Not listed
Vendors
Canonical Debian Netapp and 4 more
Products
Ubuntu Linux Debian Linux Cloud Backup and 20 more