Search CVE reports
11 – 20 of 32112 results
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Client#request overrides the request...
1 affected package
ruby-oauth2
| Package | 26.04 LTS |
|---|---|
| ruby-oauth2 | Needs evaluation |
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a...
2 affected packages
golang-github-gopacket-gopacket, gopacket
| Package | 26.04 LTS |
|---|---|
| golang-github-gopacket-gopacket | Needs evaluation |
| gopacket | Needs evaluation |
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes...
2 affected packages
golang-github-gopacket-gopacket, gopacket
| Package | 26.04 LTS |
|---|---|
| golang-github-gopacket-gopacket | Needs evaluation |
| gopacket | Needs evaluation |
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a...
1 affected package
sg3-utils
| Package | 26.04 LTS |
|---|---|
| sg3-utils | Needs evaluation |
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due...
1 affected package
rust-tiny-http
| Package | 26.04 LTS |
|---|---|
| rust-tiny-http | Needs evaluation |
tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which...
1 affected package
rust-tiny-http
| Package | 26.04 LTS |
|---|---|
| rust-tiny-http | Needs evaluation |
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()`...
12 affected packages
pypy3, python2.7, python3.4, python3.5, python3.6...
| Package | 26.04 LTS |
|---|---|
| pypy3 | Needs evaluation |
| python2.7 | Not in release |
| python3.4 | Not in release |
| python3.5 | Not in release |
| python3.6 | Not in release |
| python3.7 | Not in release |
| python3.8 | Not in release |
| python3.9 | Not in release |
| python3.10 | Not in release |
| python3.11 | Not in release |
| python3.12 | Not in release |
| python3.14 | Needs evaluation |
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who...
6 affected packages
tomcat6, tomcat7, tomcat8, tomcat9, tomcat10, tomcat11
| Package | 26.04 LTS |
|---|---|
| tomcat6 | Not in release |
| tomcat7 | Not in release |
| tomcat8 | Not in release |
| tomcat9 | Needs evaluation |
| tomcat10 | Needs evaluation |
| tomcat11 | Needs evaluation |
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite...
1 affected package
activemq
| Package | 26.04 LTS |
|---|---|
| activemq | Needs evaluation |
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a...
1 affected package
activemq
| Package | 26.04 LTS |
|---|---|
| activemq | Needs evaluation |