THREATIST.IORead the docs 73 records in Storagegrid · all components
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename.
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory.
ap_escape_quotes() may write beyond the end of a buffer when given malicious input.
Malformed requests may cause the server to dereference a NULL pointer.
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string.
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake.
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed.
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packe…
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying…
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries).
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries).
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries).
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries).