Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that …
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affec…
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate with…
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. …
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10…
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 throug…
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix do…
Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. T…
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to …
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile…
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget …
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying o…
Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell acce…
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used …
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and R…
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneC…
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1.
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulati…