Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2023-4853

Quarkus: http security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS 3.1 · 8.1 High EPSS 2.3% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Apache Camel Quarkus Build Of Optaplanner and 20 more
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2022-4492

undertow: Server identity in https connection is not checked by the undertow client

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Camel Spring Boot Integration Camel For Spring Boot and 14 more
CVE-2022-41862

postgresql: Client memory disclosure when connecting with Kerberos to modified server

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Postgresql Redhat
Products
Fedora Postgresql Enterprise Linux and 8 more
CVE-2022-1278

WildFly: possible information disclosure

A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Amq Broker Amq Online and 7 more
CVE-2021-3536

wildfly: XSS via admin console when creating roles in domain mode

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Data Grid Descision Manager and 9 more