enterprise_linux Archives - CVE Vulnerability

CVE-2018-14462

Sun, 26 Feb 2023 06:46:19 +0000

The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().

The post CVE-2018-14462 appeared first on CVE Vulnerability.

CVE-2020-10705

Sun, 26 Feb 2023 06:35:55 +0000

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the “Expect: 100-continue” header may cause an out of memory error. This flaw may potentially lead to a denial of service.

The post CVE-2020-10705 appeared first on CVE Vulnerability.

CVE-2020-10688

Sun, 26 Feb 2023 06:35:55 +0000

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

The post CVE-2020-10688 appeared first on CVE Vulnerability.

CVE-2020-10687

Sun, 26 Feb 2023 06:35:55 +0000

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

The post CVE-2020-10687 appeared first on CVE Vulnerability.

CVE-2019-17570

Sun, 26 Feb 2023 06:31:37 +0000

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

The post CVE-2019-17570 appeared first on CVE Vulnerability.

CVE-2019-16869

Sun, 26 Feb 2023 06:31:23 +0000

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a “Transfer-Encoding : chunked” line), which leads to HTTP request smuggling.

The post CVE-2019-16869 appeared first on CVE Vulnerability.

CVE-2019-14900

Sun, 26 Feb 2023 06:30:44 +0000

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

The post CVE-2019-14900 appeared first on CVE Vulnerability.

CVE-2019-14865

Sun, 26 Feb 2023 06:30:43 +0000

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.

The post CVE-2019-14865 appeared first on CVE Vulnerability.

CVE-2019-10213

Sun, 26 Feb 2023 06:29:06 +0000

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

The post CVE-2019-10213 appeared first on CVE Vulnerability.

CVE-2019-10212

Sun, 26 Feb 2023 06:29:06 +0000

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.

The post CVE-2019-10212 appeared first on CVE Vulnerability.