Priority LOW 38
Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verificat…
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01857 · Published 2025-02-11 · Partial fix · 3.4.1, 3.3.3 +2 CWE-392
Priority MEDIUM 61
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memo…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.59302 · Published 2024-04-08 · Partial fix · 3.2.2, 3.1.6 +2 CWE-1325
Priority MEDIUM 43
An issue was discovered in libxml2 before 2.10.3.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.05812 · Published 2022-11-23 · Partial fix CWE-415
Priority HIGH 67
An issue was discovered in libxml2 before 2.10.3.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.41365 · Published 2022-11-22 · Partial fix CWE-190
Priority CRITICAL 93
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.96391 · Published 2022-06-21 · Partial fix CWE-78
Priority MEDIUM 46
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04678 · Published 2022-05-03 · Fixed in 300.0.6 CWE-459
Priority LOW 29
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01228 · Published 2022-05-03 · Fixed in 300.0.6 CWE-327
Priority LOW 34
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02158 · Published 2022-05-03 · Fixed in 300.0.6 CWE-295
Priority CRITICAL 90
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.82612 · Published 2022-05-03 · Partial fix CWE-78
Priority LOW 35
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03753 · Published 2022-05-03 · Partial fix CWE-190
Priority LOW 39
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.05666 · Published 2022-04-14 · Partial fix · 5.3.19, 5.2.21.RELEASE CWE-178
Priority MEDIUM 47
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0512 · Published 2022-02-26 · Partial fix CWE-416
Priority LOW 36
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03216 · Published 2022-01-19 · Fixed CWE-400
Priority LOW 36
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03486 · Published 2022-01-19 · Partial fix
Priority LOW 36
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03486 · Published 2022-01-19 · Partial fix CWE-400
Priority LOW 36
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03306 · Published 2022-01-19 · No fix listed
Priority MEDIUM 57
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03765 · Published 2022-01-19 · Partial fix CWE-502
Priority MEDIUM 41
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.07748 · Published 2022-01-19 · Partial fix CWE-400
Priority LOW 35
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02755 · Published 2022-01-19 · Partial fix CWE-284
Priority LOW 36
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03458 · Published 2022-01-19 · Partial fix CWE-400
Priority LOW 35
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02825 · Published 2022-01-19 · Partial fix CWE-200
Priority LOW 36
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0335 · Published 2022-01-19 · Partial fix CWE-770
Priority MEDIUM 41
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.08346 · Published 2022-01-19 · Partial fix CWE-400
Priority LOW 35
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02896 · Published 2022-01-19 · Fixed CWE-284
Priority LOW 37
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03782 · Published 2022-01-19 · Partial fix CWE-693
Load more
THREATIST.IORead the docs