netapp oncommand_workflow_automation güvenlik açıkları (CVE)

7.3Yüksek

CVE-2025-0509 1 yıl önce

Signing Checks Bypass

sparkle-project Sparkle

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

4.8Orta

CVE-2025-21502 1 yıl önce

Oracle Corporation Oracle Java SE

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle Graal…

4.9Orta

CVE-2025-21492 1 yıl önce

Oracle Corporation MySQL Server

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple …

4.6Orta

CVE-2024-13176 1 yıl önce

Timing side-channel in ECDSA signature computation

OpenSSL OpenSSL

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attack…

9.8Kritik

CVE-2024-4741 1 yıl önce

Use After Free with SSL_free_buffers

OpenSSL OpenSSL

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cr…

3.2%EPSS

9.1Kritik

CVE-2024-5535 2 yıl önce

SSL_select_next_proto buffer overread

OpenSSL OpenSSL; openssl openssl; Siemens RUGGEDCOM RST2428P; Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences su…

5.6%EPSS

5.9Orta

CVE-2024-2511 2 yıl önce

Unbounded memory growth with session handling in TLSv1.3

OpenSSL OpenSSL; Siemens RUGGEDCOM RM1224 LTE(4G) EU; Siemens RUGGEDCOM RM1224 LTE(4G) NAM; Siemens RUGGEDCOM RST2428P

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial …

59%EPSS

7.5Yüksek

CVE-2024-28757 2 yıl önce

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0); Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0); Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0); Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

2.0%EPSS

7.5Yüksek

CVE-2024-1635 2 yıl önce

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

undertow; Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2; Red Hat Red Hat Fuse 7.13.0; Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the…

4.6%EPSS

8.8Yüksek

CVE-2023-41993 KEV 3 yıl önce

Apple Multiple Products WebKit Code Execution Vulnerability

Apple macOS; apple iphone_os; apple ipad_os; apple macos

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

24%EPSS

9.8Kritik

CVE-2022-1292 4 yıl önce

The c_rehash script allows command injection

OpenSSL OpenSSL; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…

83%EPSS

8.1Yüksek

CVE-2018-11776 KEV 8 yıl önce

Apache Struts Remote Code Execution Vulnerability

Apache Software Foundation Apache Struts

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

100%EPSS

8.1Yüksek

CVE-2017-12617 KEV 9 yıl önce

Apache Tomcat Remote Code Execution Vulnerability

Apache Software Foundation Apache Tomcat

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

100%EPSS

9.8Kritik

CVE-2016-3427 KEV 10 yıl önce

Oracle Java SE and JRockit Unspecified Vulnerability

oracle jdk; oracle jre; oracle jrockit; oracle linux

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

92%EPSS