Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownLog pollution can potentially lead to local HTML injectionCheck if you run itEPSS 1.49%Jul 19, 2016
- UnknownStored XSS in "gallery" applicationCheck if you run itEPSS 1.37%Jul 19, 2016
- High8.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications fr…Check this weekEPSS 50.90%Jul 19, 2016
- High8.1The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTT…Check this weekEPSS 55.72%Jul 19, 2016
- Unknownlibbpg contains a type confusion vulnerability that leads to out of bounds write libbpg is a library for the BPG graphics format.Check if you run itEPSS 2.86%Jul 13, 2016
- High7.8Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP…Check this weekEPSS 26.29%Jul 13, 2016
- High7.8Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation Services on SharePoint Serv…Check this weekEPSS 20.45%Jul 13, 2016
- Medium5.5Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 R…Check this weekEPSS 16.42%Jul 13, 2016
- Medium5.5Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote atta…Check if you run itEPSS 2.56%Jul 12, 2016
- High7.5The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 re…Check this weekEPSS 18.80%Jul 6, 2016
- Medium5.9The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which all…Check this weekEPSS 15.92%Jul 6, 2016
- Medium5.3The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.Check this weekEPSS 10.37%Jul 4, 2016
- Critical9.8The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.Check this weekEPSS 16.74%Jul 4, 2016
- High7.5Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.Check if you run itEPSS 9.75%Jul 4, 2016
- High7.5Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.Check if you run itEPSS 9.75%Jul 4, 2016
- High8.8Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.Check if you run itEPSS 3.70%Jul 4, 2016
- High7.5Boletín de seguridad: Varias vulnerabilidades de Apache Commons FileUpload afectan a IBM Tivoli Business Service Manager (CVE-2014-0034, CVE-2014-0050, CVE-2013-2186,…Check this weekEPSS 37.17%Jul 4, 2016
- High8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site sc…Check this weekEPSS 25.74%Jul 4, 2016
- High8.1ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary…Check this weekEPSS 12.71%Jul 4, 2016
- High7.5The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.Check this weekEPSS 21.26%Jul 4, 2016
- Medium6.1Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.Check if you run itEPSS 1.02%Jul 3, 2016
- Medium6.1Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers…Check if you run itEPSS 0.77%Jul 3, 2016
- High7.5HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or poss…Check this weekEPSS 42.82%Jun 30, 2016
- Medium6.5Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block end…Check this weekEPSS 15.68%Jun 30, 2016
- Medium5.5The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for…Check if you run itEPSS 1.24%Jun 20, 2016
Sort