Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 175

Export CSV
CVE-2021-20289

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Netapp Oracle Quarkus and 1 more
Products
Oncommand Insight Communications Cloud Native Core Console Quarkus and 9 more
CVE-2021-20218

fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2

CVSS 3.1 · 7.4 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
A-mq Online Amq Online Build Of Quarkus and 13 more
CVE-2020-27782

undertow: special character in query results in server errors

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Integration Jboss Enterprise Application Platform and 5 more
CVE-2020-27222

californium-core: DTLS - DoS vulnerability for certificate based handshakes

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eclipse Redhat
Products
Californium Camel Quarkus Integration
CVE-2020-27218

jetty: buffer not correctly recycled in Gzip Request inflation

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

CVSS 3.1 · 4.8 Medium EPSS 8.3% KEV · Not listed
Vendors
Apache Debian Eclipse and 3 more
Products
Kafka Spark Debian Linux and 20 more
CVE-2020-26238

Critical vulnerability found in cron-utils

Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.

CVSS 3.1 · 7.9 High EPSS 4.2% KEV · Not listed
Vendors
Cron-utils Project Redhat
Products
Cron-utils Camel Quarkus Integration and 1 more
CVE-2020-14326

RESTEasy: Caching routes in RootNode may result in DoS

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Camel Quarkus Integration and 4 more
CVE-2020-13920

activemq: improper authentication allows MITM attack

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.

CVSS 3.1 · 5.9 Medium EPSS 4.5% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Activemq Debian Linux Communications Diameter Signaling Router and 4 more
CVE-2024-8391

Eclipse Vert.x gRPC server does not limit the maximum message size

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).  This is fixed in the 4.5.10 version.  Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Eclipse Foundation Redhat
Products
Vert.x Vert.x Camel Quarkus and 3 more
CVE-2022-40156

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Camel Spring Boot
CVE-2022-40155

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus
CVE-2022-40154

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus
CVE-2022-40153

xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus