Vulnerabilities

TI-2017-02360 CVE-2017-3140 · GHSA-6f7c-h629-3xqv

An error processing RPZ rules can cause named to loop endlessly after handling a query

MEDIUM 40

If named is configured to use Response Policy Zones (RPZ) an error processing some rule types can lead to a condition where BIND will endlessly loop while handling a query.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.12184 Published 2019-01-16 No fix listed CWE-400

TI-2017-02358 CVE-2017-3138 · GHSA-q858-q2j2-9jg4

named exits with a REQUIRE assertion failure if it receives a null command string on its control channel

LOW 37

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.05503 Published 2019-01-16 No fix listed CWE-617

TI-2017-02357 CVE-2017-3137 · GHSA-wmp5-3j44-5x2x

A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

MEDIUM 44

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when process…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08902 Published 2019-01-16 Partial fix CWE-617

TI-2017-02356 CVE-2017-3136 · GHSA-835v-j5fw-qqvq

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

MEDIUM 40

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.11093 Published 2019-01-16 Fixed CWE-617

TI-2017-11069 CVE-2017-15095 · GHSA-h592-38cm-4ggp

Deserialization of untrusted data in FasterXML jackson-databind

MEDIUM 60

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readV…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08357 Published 2018-02-06 Partial fix · 2.8.10, 2.9.1 +4 CWE-184

TI-2017-05167 CVE-2017-7525 · GHSA-qxxx-2pp7-5hmx

Deserialization of untrusted data in FasterXML jackson-databind

HIGH 75

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.37721 Published 2018-02-06 Partial fix · 2.6.7.1, 2.7.9.1 +1 CWE-184

TI-2017-11480 CVE-2017-15707 · GHSA-xcrm-qpp8-hcw4

Improper input validation in Apache Struts

LOW 35

In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.

CVSS 3.0MEDIUM 6.2 Local No auth No interaction EPSS 0.04889 Published 2017-12-01 Fixed in 2.5.16 CWE-20

TI-2016-07072 CVE-2016-8610 · GHSA-v2q2-jxh8-m5h8

Uncontrolled resource consumption in OpenSSL

MEDIUM 60

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.39919 Published 2017-11-13 Partial fix CWE-400

TI-2017-07727 CVE-2017-10388 · GHSA-8j2p-7p84-f2f5

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 41

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.03206 Published 2017-10-19 Partial fix

TI-2017-07723 CVE-2017-10384 · GHSA-w2fh-3rw7-vr98

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

LOW 34

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03103 Published 2017-10-19 Partial fix

TI-2017-07718 CVE-2017-10379 · GHSA-hr5m-vvhf-96cx

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client…

LOW 33

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02298 Published 2017-10-19 Partial fix CWE-863

TI-2017-07717 CVE-2017-10378 · GHSA-wp4q-xxr9-wwm7

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 35

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03264 Published 2017-10-19 Partial fix

TI-2017-07708 CVE-2017-10365 · GHSA-ccjx-qqqf-fmq3

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 22

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB).

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.01723 Published 2017-10-19 Fixed

TI-2017-07700 CVE-2017-10357 · GHSA-g4h8-pg44-c6f7

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07699 CVE-2017-10356 · GHSA-48hc-p2wv-prx2

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 29

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security).

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00754 Published 2017-10-19 Partial fix

TI-2017-07698 CVE-2017-10355 · GHSA-c7m6-53c4-386j

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

MEDIUM 47

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.16181 Published 2017-10-19 Partial fix

TI-2017-07693 CVE-2017-10350 · GHSA-gxhg-2xqp-6h9p

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAX-WS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07692 CVE-2017-10349 · GHSA-rm36-hx9f-89cx

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07691 CVE-2017-10348 · GHSA-v47r-hqv5-fhh8

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03305 Published 2017-10-19 Partial fix

TI-2017-07690 CVE-2017-10347 · GHSA-jvfh-rgp2-xc77

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent…

LOW 36

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03114 Published 2017-10-19 Partial fix

TI-2017-07689 CVE-2017-10346 · GHSA-m98w-5j58-c7m7

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent…

MEDIUM 48

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot).

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.02962 Published 2017-10-19 Partial fix

TI-2017-07688 CVE-2017-10345 · GHSA-p7q9-c7hh-v46v

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 20

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization).

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.02442 Published 2017-10-19 Partial fix

TI-2017-07663 CVE-2017-10320 · GHSA-gff5-pcpw-x8w8

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server…

LOW 26

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01942 Published 2017-10-19 Fixed

TI-2017-07652 CVE-2017-10309 · GHSA-5269-8f5r-q5c5

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).

MEDIUM 43

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment).

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.08794 Published 2017-10-19 Fixed

TI-2017-07642 CVE-2017-10295 · GHSA-vg5w-8wf5-8234

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE…

LOW 23

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking).

CVSS 3.1MEDIUM 4.0 Network No auth No interaction EPSS 0.02199 Published 2017-10-19 Partial fix

Vulnerabilities

Filters