Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2023-5685

Xnio: stackoverflowexception when the chain of notifier states becomes problematically big

A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Apache-camel-spring-boot Apache Camel Hawtio Build Keycloak and 9 more
CVE-2023-2976

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Guava Amq Broker Amq Streams and 7 more
CVE-2024-21733

Apache Tomcat: Leaking of unrelated request bodies in default error page

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

CVSS 3.1 · 5.3 Medium EPSS 14.3% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Apache-camel-spring-boot Jboss Fuse
CVE-2024-32007

Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. 

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Apache-camel-spring-boot Apache Camel Spring Boot and 1 more
CVE-2024-29736

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Apache-camel-spring-boot Apache Camel Spring Boot
CVE-2023-35116

jackson-databind: denial of service via cylic dependencies

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure and trying to serialize it cannot be achieved by an external attacker.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Fasterxml Redhat
Products
Jackson-databind Amq Broker Apache-camel-spring-boot and 4 more