CVE-2013-2067

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

CVSS 2.0 · 6.8 Medium EPSS 10.4% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2012-5887

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

CVSS 2.0 · 5.0 Medium EPSS 12.1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Data Grid and 5 more

CVE-2012-5886

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

CVSS 2.0 · 5.0 Medium EPSS 8.8% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Data Grid and 5 more

CVE-2012-5885

tomcat: three DIGEST authentication implementation issues

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

CVSS 2.0 · 5.0 Medium EPSS 9.0% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Data Grid and 5 more

CVE-2012-4534

Tomcat - Denial Of Service when using NIO+SSL+sendfile

org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.

CVSS 2.0 · 2.6 Low EPSS 7.5% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2011-3389

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVSS 2.0 · 4.3 Medium EPSS 73.3% KEV · Not listed

Vendors

Canonical Debian Google and 6 more

Products

Ubuntu Linux Debian Linux Chrome and 18 more

CVE-2026-87742

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Of Quarkus Enterprise Linux Ai Exploit Intelligence and 1 more

CVE-2023-51714

qt: incorrect integer overflow check

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Debian Qt Redhat

Products

Debian Linux Qt Enterprise Linux

CVE-2023-48161

giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Giflib Project Redhat

Products

Giflib Enterprise Linux Openjdk and 5 more

CVE-2023-42794

Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

CVSS 3.1 · 5.9 Medium EPSS 2.3% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server and 1 more

CVE-2023-30590

nodejs: DiffieHellman do not generate keys after setting a private key

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Nodejs Redhat

Products

Node.js Enterprise Linux Rhel Eus

CVE-2023-30589

nodejs: HTTP Request Smuggling via Empty headers separated by CR

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Fedoraproject Nodejs Redhat

Products

Fedora Node.js Enterprise Linux and 1 more

CVE-2023-2269

kernel: A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 11 more

CVE-2023-23946

Git's `git apply` overwriting paths outside the working tree

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

CVSS 3.1 · 6.2 Medium EPSS 1.1% KEV · Not listed

Vendors

Git-scm Redhat

Products

Git Enterprise Linux Rhel Eus

CVE-2023-22490

Git vulnerable to local clone-based data exfiltration with non-local transports

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Git-scm Redhat

Products

Git Enterprise Linux Rhel Eus

CVE-2023-20900

open-vm-tools: SAML token signature bypass

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 4 more

Products

Debian Linux Fedora Linux Kernel and 9 more

CVE-2023-1838

kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend()

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H410c and 6 more

CVE-2022-32189

Panic when decoding Float and Rat types in math/big

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed

Vendors

Golang Redhat

Products

Go Ceph Storage Container Native Virtualization and 10 more

CVE-2022-25762

Response mix-up with WebSocket concurrent send and close

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.

CVSS 3.1 · 8.6 High EPSS 8.4% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Tomcat Agile Product Lifecycle Management Enterprise Linux

CVE-2022-23960

hw: cpu: arm64: Spectre-BHB

Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Arm Debian Redhat and 1 more

Products

Cortex-a57 Cortex-a57 Firmware Cortex-a65 and 42 more