Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,827

Export CSV
CVE-2012-2945

hadoop: symlink vulnerability in conf/hadoop-env.sh

Hadoop 1.0.3 contains a symlink vulnerability.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Apache
Products
Hadoop
CVE-2012-1592

struts2: xsltResult local code execution flaw

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

CVSS 3.1 · 8.8 High EPSS 28.5% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2011-3923

struts2: Remote code execution via OGNL injention in HTTP parameter values

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 89.5% KEV · Not listed
Vendors
Apache Redhat
Products
Struts Jboss Enterprise Web Server
CVE-2011-3600

XML-RPC SAX parser information exposure

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

CVSS 3.1 · 7.5 High EPSS 15.9% KEV · Not listed
Vendors
Apache
Products
Ofbiz
CVE-2011-2177

OpenOffice.org: InteVyDis Demo of OpenOffice 0day. Released with VulnDisco 8.8 pack (release date May,2009)

OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
Openoffice
CVE-2024-42361

GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Apache
Products
Hertzbeat
CVE-2024-42362

GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Apache Dromara
Products
Hertzbeat Hertzbeat