Search CVE reports
11 – 20 of 59781 results
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages....
1 affected package
wss4j
| Package | 16.04 LTS |
|---|---|
| wss4j | Needs evaluation |
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd...
1 affected package
apache2
| Package | 16.04 LTS |
|---|---|
| apache2 | Needs evaluation |
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string...
1 affected package
geopy
| Package | 16.04 LTS |
|---|---|
| geopy | Needs evaluation |
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent...
1 affected package
apache2
| Package | 16.04 LTS |
|---|---|
| apache2 | Needs evaluation |
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via...
1 affected package
apache2
| Package | 16.04 LTS |
|---|---|
| apache2 | Needs evaluation |
The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this...
1 affected package
jackson-dataformat-smile
| Package | 16.04 LTS |
|---|---|
| jackson-dataformat-smile | Needs evaluation |
The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this...
1 affected package
jackson-dataformat-cbor
| Package | 16.04 LTS |
|---|---|
| jackson-dataformat-cbor | Needs evaluation |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects...
1 affected package
apache2
| Package | 16.04 LTS |
|---|---|
| apache2 | Needs evaluation |
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose...
1 affected package
apache2
| Package | 16.04 LTS |
|---|---|
| apache2 | Needs evaluation |
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP...
1 affected package
apache2
| Package | 16.04 LTS |
|---|---|
| apache2 | Needs evaluation |