Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2023-6841

Keycloak: amount of attributes per object is not limited and it may lead to dos

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Fuse Keycloak and 5 more
CVE-2016-8705

memcached: Server update remote code execution

Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

CVSS 3.0 · 9.8 Critical EPSS 19.9% KEV · Not listed
Vendors
Memcached Redhat
Products
Memcached Enterprise Linux Mobile Application Platform
CVE-2017-1000117

git: Command injection via malicious ssh URLs

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.

CVSS 3.0 · 8.8 High EPSS 77.8% KEV · Not listed
Vendors
Git-scm Redhat
Products
Git Enterprise Linux Mobile Application Platform and 1 more
CVE-2017-15010

nodejs-tough-cookie: Regular expression denial of service

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

CVSS 3.0 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Redhat Salesforce
Products
Mobile Application Platform Rhel Software Collections Tough-cookie
CVE-2017-7552

RHMAP Millicore IDE allows RCE on SCM

A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which allows files to be executed as well as created. An attacker could use this flaw to compromise other users or teams projects stored in source control management of the RHMAP Core installation.

CVSS 3.0 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Mobile Application Platform
CVE-2016-8704

memcached: Server append/prepend remote code execution

An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

CVSS 3.0 · 9.8 Critical EPSS 23.2% KEV · Not listed
Vendors
Memcached Redhat
Products
Memcached Enterprise Linux Mobile Application Platform
CVE-2017-7554

RHMAP: Stored XSS in App Store

It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use this flaw to execute a stored XSS attack on an application administrator using App Studio.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Mobile Application Platform
CVE-2017-7553

RHMAP: SSRF via external_request feature of App Studio

The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could use this flaw to probe the network internal resources, and access restricted endpoints.

CVSS 3.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Mobile Application Platform
CVE-2020-1723

keycloak: logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to arbitrary web pages

A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper (Louketo): 6.0.1, 7.0.0

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Keycloak Gatekeeper Project Redhat
Products
Keycloak Gatekeeper Mobile Application Platform
CVE-2018-3728

hoek: Prototype pollution in utilities function

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

CVSS 3.0 · 8.8 High EPSS 4.2% KEV · Not listed
Vendors
Hapijs Redhat
Products
Hoek Mobile Application Platform Quay