Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2020-11022

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 99.2% KEV · Not listed
Vendors
Debian Drupal Fedoraproject and 6 more
Products
Debian Linux Drupal Fedora and 85 more
CVE-2017-5645

log4j: Socket receiver deserialization vulnerability

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 89.4% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Log4j Oncommand Api Services Oncommand Insight and 83 more
CVE-2021-44832

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

CVSS 3.1 · 6.6 Medium EPSS 97.9% KEV · Not listed
Vendors
Apache Cisco Debian and 3 more
Products
Log4j Cloudcenter Debian Linux and 28 more
CVE-2020-9488

log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

CVSS 3.1 · 3.7 Low EPSS 8.2% KEV · Not listed
Vendors
Apache Debian Oracle and 2 more
Products
Log4j Debian Linux Communications Application Session Controller and 50 more
CVE-2019-11358

jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVSS 3.1 · 6.1 Medium EPSS 86.8% KEV · Not listed
Vendors
Backdropcms Debian Drupal and 8 more
Products
Backdrop Debian Linux Drupal and 111 more