Export limit exceeded: 15575 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425826 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2021-32742

Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Vapor Project
Products
Vapor
CVE-2021-21328

Denial of Service

Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Vapor Project
Products
Vapor
CVE-2020-15230

Arbitrary file read un Vapor

Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.

CVSS 3.1 · 8.5 High EPSS 1.5% KEV · Not listed
Vendors
Vapor Project
Products
Vapor