Repository navigation
Expand file tree
/
Copy pathreport_lab.html
More file actions
176 lines (172 loc) · 190 KB
/
Copy pathreport_lab.html
File metadata and controls
176 lines (172 loc) · 190 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
<!doctype html>
<html lang="pt-BR"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>ChimangoScan · varredura multi-scanner de containers vulneráveis</title>
<style>
*{box-sizing:border-box}
:root{--bg:#f6f7f9;--fg:#1e293b;--mut:#64748b;--line:#e2e8f0;--card:#fff;--accent:#0f766e;--accent-d:#0b1220}
html{scroll-behavior:smooth;scroll-padding-top:60px}
body{font:14.5px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;margin:0;color:var(--fg);background:var(--bg)}
a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
header.top{background:var(--accent-d);color:#e2e8f0;padding:26px 22px 22px}
header.top h1{margin:0;font-size:21px;font-weight:650;letter-spacing:-.01em}
header.top .sub{color:#94a3b8;font-size:13px;margin-top:6px;max-width:900px}
header.top code{color:#5eead4}
nav.sticky{position:sticky;top:0;z-index:20;background:rgba(255,255,255,.93);backdrop-filter:blur(6px);border-bottom:1px solid var(--line);padding:8px 22px;display:flex;gap:18px;flex-wrap:wrap;font-size:13px;font-weight:550}
nav.sticky a{color:var(--mut)}nav.sticky a:hover{color:var(--fg)}
main{max-width:1180px;margin:0 auto;padding:18px 22px 60px}
section{margin:34px 0 0}
h2{font-size:16.5px;font-weight:650;margin:0 0 4px;letter-spacing:-.01em}
h2 .sub{font-weight:400;font-size:13px;color:var(--mut);margin-left:2px}
p.note{color:var(--mut);font-size:13px;margin:6px 0 14px;max-width:940px}
.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin:18px 0}
.card{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:13px 15px}
.card .v{font-size:23px;font-weight:680;letter-spacing:-.02em}
.card .l{font-size:11px;color:var(--mut);text-transform:uppercase;letter-spacing:.05em;margin-top:3px}
.card .s{font-size:11.5px;color:var(--mut);margin-top:4px}
.legend{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:11px 14px;font-size:13px;margin:0 0 10px}
.chip{display:inline-block;padding:1px 8px;border-radius:11px;color:#fff;font-size:11px;font-weight:600;vertical-align:1px}
table{border-collapse:collapse;width:100%;background:var(--card);font-size:13px;border:1px solid var(--line);border-radius:10px;overflow:hidden}
th,td{text-align:left;padding:7px 11px;border-bottom:1px solid #f1f5f9;vertical-align:top}
th{background:#fbfcfd;font-weight:600;color:#334155;cursor:pointer;user-select:none;white-space:nowrap}
th.no-sort{cursor:default}
tbody tr:hover{background:#fafbfc}
td.num,th.num{text-align:right;font-variant-numeric:tabular-nums}
.mono{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px}
.b{font-weight:600}.muted{color:var(--mut)}.warn{color:#b45309;font-size:11px;font-weight:600}
.sevbar{display:inline-flex;height:11px;border-radius:3px;overflow:hidden;vertical-align:middle;background:#eef1f4}
.sevbar span{display:block;height:100%}
.hbar{display:inline-block;width:90px;height:9px;border-radius:5px;background:#eef1f4;vertical-align:middle;overflow:hidden}
.hbar span{display:block;height:100%;background:var(--accent)}
.heat td{text-align:right;font-variant-numeric:tabular-nums}
.toolbar{display:flex;gap:10px;align-items:center;margin:10px 0 0}
.toolbar input{flex:1;max-width:340px;padding:6px 10px;border:1px solid var(--line);border-radius:8px;font:inherit}
.scroll{max-height:560px;overflow:auto;border:1px solid var(--line);border-radius:10px}
.scroll table{border:0;border-radius:0}.scroll th{position:sticky;top:0}
footer{margin-top:46px;padding-top:18px;border-top:1px solid var(--line);color:var(--mut);font-size:12.5px}
@media(max-width:640px){nav.sticky{gap:12px}}
</style></head><body>
<header class="top">
<h1>ChimangoScan — varredura multi-scanner de containers vulneráveis</h1>
<div class="sub"><b>145</b> imagens de container vulneráveis (corpus <code>LabVulnerabilities</code>) varridas por uma bateria de <b>7</b> scanners estáticos de segurança, em duas máquinas, via a pipeline distribuída <a href="https://github.com/ChimangoScan/scanners">ChimangoScan/scanners</a>. <b>475 937</b> findings consolidados; cada um traceia de volta para a imagem (e o IP do container) que o originou. Gerado em 2026-05-12 05:34 UTC.</div>
</header>
<nav class="sticky">
<a href="#resumo">Resumo</a><a href="#desempenho">Desempenho</a><a href="#scanners">Cobertura por scanner</a>
<a href="#concordancia">Concordância</a><a href="#severidade">Severidade × categoria</a>
<a href="#expostos">Mais expostos</a><a href="#containers">Todos os containers</a><a href="#findings">Findings</a>
</nav>
<main>
<section id="resumo">
<h2>Resumo <span class="sub">o que foi medido</span></h2>
<p class="note">Bateria estática (varre o <code>docker save</code> tar da imagem e o rootfs achatado — não precisa rodar o container): <b>syft</b> (SBOM), <b>trivy</b> · <b>grype</b> · <b>osv-scanner</b> · <b>clair</b> (CVEs de pacote, quatro motores), <b>dockle</b> (boas práticas/config da imagem), <b>trufflehog</b> (segredos). Os 145 containers já tinham resultados de OpenVAS coletados (scanner de rede dinâmico — referência). Scanners de filesystem lentos (clamav) ou quebrados (semgrep — erro de config) aparecem nas tabelas, sinalizados, mas não geraram findings.</p>
<div class="cards"><div class="card"><div class="v">145</div><div class="l">containers escaneados</div></div><div class="card"><div class="v">475 937</div><div class="l">findings (consolidados)</div></div><div class="card"><div class="v">15 811</div><div class="l">críticos</div><div class="s">+65 731 altos</div></div><div class="card"><div class="v">17 932</div><div class="l">CVEs distintos</div></div><div class="card"><div class="v">7</div><div class="l">scanners (com saída)</div></div><div class="card"><div class="v">76.7</div><div class="l">containers / hora</div><div class="s">≈ 226.1 s por container</div></div></div>
<div class="legend"><b>Severidade:</b> <span class="chip" style="background:#991b1b">critical</span> 15 811 <span class="chip" style="background:#dc2626">high</span> 65 731 <span class="chip" style="background:#d97706">medium</span> 191 006 <span class="chip" style="background:#16a34a">low</span> 62 617 <span class="chip" style="background:#64748b">info</span> 83 857 <span class="chip" style="background:#94a3b8">unknown</span> 56 915</div>
<div class="legend"><b>Categoria:</b> <b>428 349</b> pacote/CVE <b>43 553</b> componente (SBOM) <b>3 210</b> segredo <b>825</b> config da imagem</div>
</section>
<section id="desempenho">
<h2>Desempenho <span class="sub">throughput da varredura</span></h2>
<p class="note">Vazão ponta-a-ponta dos 145 containers (inclui intervalos de reinício de workers — em regime estável foi mais rápido). <b>Paralelismo efetivo</b> = média de containers de scanner rodando ao mesmo tempo.</p>
<table style="max-width:560px"><thead><tr><th class="no-sort">métrica</th><th class="no-sort num">valor</th></tr></thead><tbody><tr><td>relógio de parede (s)</td><td class="num mono">6806.0</td></tr><tr><td>containers / minuto</td><td class="num mono">1.278</td></tr><tr><td>containers / hora</td><td class="num mono">76.7</td></tr><tr><td>média s / container</td><td class="num mono">226.1</td></tr><tr><td>mediana s / container</td><td class="num mono">171.0</td></tr><tr><td>CPU-segundos de scanner (total)</td><td class="num mono">37680.0</td></tr><tr><td>paralelismo efetivo (scanner-containers simultâneos)</td><td class="num mono">5.54</td></tr></tbody></table>
</section>
<section id="scanners">
<h2>Cobertura por scanner</h2>
<p class="note"><b>runs</b> = invocações · <b>ok</b> = % que terminou com saída útil · <b>tempo méd.</b> = parede por invocação · <b>brutos → consolidados</b> = depois do dedup intra-scanner · <b>fatia</b> = % do total consolidado. Clique para ordenar.</p>
<table id="t-scan"><thead><tr><th class="no-sort">scanner</th><th class="num">runs</th><th class="num">ok</th><th class="num">tempo méd.</th><th class="num">mem. pico</th><th class="num">brutos</th><th class="num">consolidados</th><th class="no-sort">fatia</th></tr></thead><tbody><tr><td class="mono b">grype</td><td class="num">145</td><td class="num">100%</td><td class="num">74.2 s</td><td class="num">2 217 MB</td><td class="num">281 200</td><td class="num">281 066</td><td><span class="hbar"><span style="width:100.0%"></span></span> 59.1%</td></tr><tr><td class="mono b">trivy <span class="warn">45 erro(s)</span></td><td class="num">145</td><td class="num">69%</td><td class="num">38.7 s</td><td class="num">912 MB</td><td class="num">92 116</td><td class="num">92 087</td><td><span class="hbar"><span style="width:32.8%"></span></span> 19.3%</td></tr><tr><td class="mono b">osv <span class="warn">1 erro(s)</span></td><td class="num">145</td><td class="num">99%</td><td class="num">29.1 s</td><td class="num">3 178 MB</td><td class="num">166 231</td><td class="num">56 241</td><td><span class="hbar"><span style="width:20.0%"></span></span> 11.8%</td></tr><tr><td class="mono b">syft</td><td class="num">145</td><td class="num">100%</td><td class="num">30.3 s</td><td class="num">1 351 MB</td><td class="num">43 630</td><td class="num">43 553</td><td><span class="hbar"><span style="width:15.5%"></span></span> 9.2%</td></tr><tr><td class="mono b">trufflehog</td><td class="num">145</td><td class="num">100%</td><td class="num">38.2 s</td><td class="num">3 065 MB</td><td class="num">16 318</td><td class="num">3 122</td><td><span class="hbar"><span style="width:1.1%"></span></span> 0.7%</td></tr><tr><td class="mono b">dockle</td><td class="num">145</td><td class="num">100%</td><td class="num">16.4 s</td><td class="num">63 MB</td><td class="num">636</td><td class="num">636</td><td><span class="hbar"><span style="width:0.2%"></span></span> 0.1%</td></tr><tr><td class="mono b">semgrep <span class="warn">falhou em todas</span></td><td class="num">145</td><td class="num">0%</td><td class="num">5.4 s</td><td class="num">0 MB</td><td class="num">0</td><td class="num">0</td><td><span class="hbar"><span style="width:0.0%"></span></span> 0.0%</td></tr><tr><td class="mono b">clamav <span class="muted">(parcial — removido: lento)</span></td><td class="num">12</td><td class="num">100%</td><td class="num">334.2 s</td><td class="num">1 221 MB</td><td class="num">0</td><td class="num">0</td><td><span class="hbar"><span style="width:0.0%"></span></span> 0.0%</td></tr></tbody></table>
</section>
<section id="concordancia">
<h2>Concordância entre os scanners de CVE <span class="sub">trivy · grype · osv · clair</span></h2>
<p class="note">Esses scanners medem a <i>mesma</i> coisa (CVEs de pacote) — só conta como "concordância" quando o mesmo CVE é reportado para o mesmo pacote no mesmo caminho. A concordância exata é baixa em parte porque os scanners normalizam nomes de pacote diferente (<code>org.apache.activemq:activemq-client</code> vs <code>activemq-client</code>) — não porque algum esteja errado. Trufflehog (segredos), syft (componentes) e dockle (config) medem outras coisas e não entram aqui.</p>
<table style="max-width:560px"><thead><tr><th class="no-sort">acordo</th><th class="no-sort num">CVEs de pacote</th><th class="no-sort num">% dos CVEs</th></tr></thead><tbody><tr><td>encontrado por <b>1</b> scanner(s) de CVE</td><td class="num">427 581</td><td class="num">99.8%</td></tr><tr><td>encontrado por <b>2</b> scanner(s) de CVE</td><td class="num">768</td><td class="num">0.2%</td></tr></tbody></table>
</section>
<section id="severidade">
<h2>Severidade × categoria</h2>
<p class="note">Findings consolidados em cada cruzamento severidade × categoria (intensidade ∝ √contagem).</p>
<table class="heat" id="t-sxc"><thead><tr><th class="no-sort">severidade</th><th class="no-sort num">pacote/CVE</th><th class="no-sort num">componente (SBOM)</th><th class="no-sort num">segredo</th><th class="no-sort num">config da imagem</th><th class="no-sort num">total</th></tr></thead><tbody></tbody></table>
</section>
<section id="expostos">
<h2>Containers mais expostos <span class="sub">top 25 por (críticos×4 + altos)</span></h2>
<p class="note">Onde se concentram os achados de alta gravidade. <code>IP</code> é o endereço do container no lab — a chave de correlação vuln↔container.</p>
<table id="t-exp"><thead><tr><th>container</th><th>imagem</th><th>IP</th><th>categoria</th><th class="num">findings</th><th class="num">crít.</th><th class="num">altos</th><th class="no-sort">severidade</th></tr></thead><tbody></tbody></table>
</section>
<section id="containers">
<h2>Todos os 145 containers</h2>
<p class="note">Clique no cabeçalho para ordenar; filtre por nome/imagem/IP/categoria.</p>
<div class="toolbar"><input id="q-cont" placeholder="filtrar containers…"><span class="muted" id="q-cont-n"></span></div>
<div class="scroll"><table id="t-cont"><thead><tr><th>container</th><th>imagem</th><th>IP</th><th>categoria</th><th class="num">findings</th><th class="num">crít.</th><th class="num">altos</th><th class="num">médios</th><th class="num">baixos</th><th class="num">info</th><th class="no-sort">severidade</th><th>obs.</th></tr></thead><tbody></tbody></table></div>
</section>
<section id="findings">
<h2>Findings de maior severidade <span class="sub">top 400</span></h2>
<p class="note">Ordenados por severidade e CVSS. Filtre por CVE, pacote, container, IP, scanner. (O conjunto completo — 475 937 findings — está em <code>findings.jsonl</code>; os outputs nativos de cada scanner, em <b>todos os formatos que geram</b>, em <code>out/<container>/<scanner>/</code>.)</p>
<div class="toolbar"><input id="q-find" placeholder="filtrar findings…"><span class="muted" id="q-find-n"></span></div>
<div class="scroll"><table id="t-find"><thead><tr><th>sev</th><th class="num">CVSS</th><th>id</th><th>título</th><th>categoria</th><th>pacote / local</th><th>versão → fix</th><th>container</th><th>IP</th><th>visto por</th></tr></thead><tbody></tbody></table></div>
</section>
<footer>
<p><b>Metodologia.</b> Pipeline <a href="https://github.com/ChimangoScan/scanners">ChimangoScan/scanners</a> — fila de trabalho distribuída, um container Docker por scanner (endurecido: <code>cap-drop ALL</code>, rootfs read-only, limites de memória/PIDs, rede isolada), normalização e dedup de findings com <code>found_by</code>, importação dos resultados de OpenVAS por IP. Severidade <code>unknown</code> = sem rating/CVSS atribuído pelo scanner. "consolidados" = depois do dedup intra-scanner (mesmo CVE/pacote/caminho).</p>
<p>Comparação metodológica anterior (35 ferramentas × 3 alvos canônicos): <a href="scanner-bench-35tools.html">scanner-bench-35tools.html</a> · Gerado em 2026-05-12 05:34 UTC.</p>
</footer>
</main>
<script id="data" type="application/json">{"summary": {"targets": 145, "targets_scanned": 145, "scanners": 8, "findings_merged": 475937, "findings_by_severity": {"critical": 15811, "high": 65731, "medium": 191006, "low": 62617, "info": 83857, "unknown": 56915}, "findings_by_category": {"pkg-vuln": 428349, "secret": 3210, "image-config": 825, "sbom-component": 43553}, "scanner_stats": {"syft": {"runs": 145, "ok": 145, "avg_wall_s": 30.3, "peak_mem_mb": 1350.7, "raw_findings": 43630, "merged_findings": 43553}, "trivy": {"runs": 145, "ok": 100, "avg_wall_s": 38.7, "peak_mem_mb": 911.6, "raw_findings": 92116, "merged_findings": 92087}, "grype": {"runs": 145, "ok": 145, "avg_wall_s": 74.2, "peak_mem_mb": 2217.0, "raw_findings": 281200, "merged_findings": 281066}, "osv": {"runs": 145, "ok": 144, "avg_wall_s": 29.1, "peak_mem_mb": 3177.5, "raw_findings": 166231, "merged_findings": 56241}, "dockle": {"runs": 145, "ok": 145, "avg_wall_s": 16.4, "peak_mem_mb": 62.7, "raw_findings": 636, "merged_findings": 636}, "trufflehog": {"runs": 145, "ok": 145, "avg_wall_s": 38.2, "peak_mem_mb": 3064.8, "raw_findings": 16318, "merged_findings": 3122}, "semgrep": {"runs": 145, "ok": 0, "avg_wall_s": 5.4, "peak_mem_mb": 0.0, "raw_findings": 0, "merged_findings": 0}, "clamav": {"runs": 12, "ok": 12, "avg_wall_s": 334.2, "peak_mem_mb": 1220.6, "raw_findings": 0, "merged_findings": 0}}, "pkg_vuln_agreement": {"1": 427581, "2": 768}, "targets_with_ip": 145, "throughput": {"wall_clock_seconds": 6806.0, "targets_per_minute": 1.278, "targets_per_hour": 76.7, "avg_seconds_per_target": 226.1, "median_seconds_per_target": 171.0, "scanner_cpu_seconds_total": 37680.0, "parallel_efficiency": 5.54}}, "targets": [{"name": "debian9", "image": "debian:stretch", "ip": "172.31.1.4", "category": "Base Operating Systems", "n": 373, "crit": 25, "high": 74, "med": 28, "low": 87, "info": 158, "unk": 1, "note": ""}, {"name": "fedora28", "image": "fedora:28", "ip": "172.31.1.8", "category": "Base Operating Systems", "n": 259, "crit": 0, "high": 22, "med": 32, "low": 11, "info": 184, "unk": 10, "note": ""}, {"name": "ubuntu16", "image": "ubuntu:16.04", "ip": "172.31.1.2", "category": "Base Operating Systems", "n": 768, "crit": 0, "high": 7, "med": 149, "low": 192, "info": 212, "unk": 208, "note": ""}, {"name": "alpine37", "image": "alpine:3.7", "ip": "172.31.1.7", "category": "Base Operating Systems", "n": 59, "crit": 7, "high": 24, "med": 8, "low": 6, "info": 13, "unk": 1, "note": ""}, {"name": "debian8", "image": "debian:jessie", "ip": "172.31.1.3", "category": "Base Operating Systems", "n": 350, "crit": 0, "high": 29, "med": 49, "low": 70, "info": 202, "unk": 0, "note": ""}, {"name": "centos7", "image": "centos:7", "ip": "172.31.1.6", "category": "Base Operating Systems", "n": 1627, "crit": 7, "high": 75, "med": 707, "low": 674, "info": 164, "unk": 0, "note": ""}, {"name": "centos6", "image": "centos:6", "ip": "172.31.1.5", "category": "Base Operating Systems", "n": 1677, "crit": 5, "high": 91, "med": 698, "low": 740, "info": 143, "unk": 0, "note": ""}, {"name": "ubuntu14", "image": "ubuntu:14.04", "ip": "172.31.1.1", "category": "Base Operating Systems", "n": 2728, "crit": 0, "high": 34, "med": 883, "low": 538, "info": 399, "unk": 874, "note": ""}, {"name": "drupal7", "image": "drupal:7", "ip": "172.31.1.84", "category": "CMS and Web Platforms", "n": 5836, "crit": 35, "high": 1064, "med": 2723, "low": 790, "info": 814, "unk": 410, "note": ""}, {"name": "dokuwiki", "image": "mprasil/dokuwiki:latest", "ip": "172.30.32.2", "category": "CMS and Web Platforms", "n": 2429, "crit": 0, "high": 28, "med": 1241, "low": 398, "info": 220, "unk": 542, "note": ""}, {"name": "joomla38", "image": "joomla:3.8", "ip": "172.31.1.86", "category": "CMS and Web Platforms", "n": 2818, "crit": 296, "high": 903, "med": 696, "low": 332, "info": 468, "unk": 123, "note": ""}, {"name": "drupal85", "image": "drupal:8.5", "ip": "172.31.1.85", "category": "CMS and Web Platforms", "n": 2473, "crit": 213, "high": 755, "med": 619, "low": 300, "info": 479, "unk": 107, "note": ""}, {"name": "wordpress-vuln", "image": "wordpress:4.6", "ip": "172.30.11.1", "category": "CMS and Web Platforms", "n": 1618, "crit": 40, "high": 225, "med": 574, "low": 231, "info": 442, "unk": 106, "note": ""}, {"name": "wp49", "image": "wordpress:4.9", "ip": "172.31.1.83", "category": "CMS and Web Platforms", "n": 2724, "crit": 294, "high": 868, "med": 688, "low": 333, "info": 428, "unk": 113, "note": ""}, {"name": "couchdb-old", "image": "couchdb:1.6", "ip": "172.30.14.6", "category": "Databases", "n": 865, "crit": 0, "high": 82, "med": 271, "low": 123, "info": 328, "unk": 61, "note": ""}, {"name": "owncloud-old", "image": "owncloud:9.1", "ip": "172.30.31.1", "category": "CMS and Web Platforms", "n": 3035, "crit": 266, "high": 1018, "med": 719, "low": 356, "info": 555, "unk": 121, "note": ""}, {"name": "owncloud9", "image": "owncloud:9", "ip": "172.31.1.92", "category": "CMS and Web Platforms", "n": 3035, "crit": 266, "high": 1018, "med": 719, "low": 356, "info": 555, "unk": 121, "note": ""}, {"name": "redmine33", "image": "redmine:3.3", "ip": "172.31.1.95", "category": "CMS and Web Platforms", "n": 5908, "crit": 351, "high": 1576, "med": 1834, "low": 553, "info": 1434, "unk": 160, "note": ""}, {"name": "cassandra22", "image": "cassandra:2.2", "ip": "172.31.1.34", "category": "Databases", "n": 2246, "crit": 11, "high": 119, "med": 814, "low": 363, "info": 265, "unk": 674, "note": ""}, {"name": "mongo32", "image": "mongo:3.2", "ip": "172.31.1.30", "category": "Databases", "n": 453, "crit": 0, "high": 46, "med": 98, "low": 78, "info": 206, "unk": 25, "note": ""}, {"name": "elasticsearch-old", "image": "elasticsearch:2.4.6", "ip": "172.30.14.5", "category": "Databases", "n": 1602, "crit": 114, "high": 316, "med": 321, "low": 195, "info": 476, "unk": 180, "note": ""}, {"name": "mongo36", "image": "mongo:3.6", "ip": "172.31.1.31", "category": "Databases", "n": 1167, "crit": 5, "high": 73, "med": 237, "low": 226, "info": 231, "unk": 395, "note": ""}, {"name": "mariadb10", "image": "mariadb:10.0", "ip": "172.31.1.27", "category": "Databases", "n": 5187, "crit": 0, "high": 21, "med": 3205, "low": 569, "info": 327, "unk": 1065, "note": ""}, {"name": "es24", "image": "elasticsearch:2.4", "ip": "172.31.1.64", "category": "Databases", "n": 1602, "crit": 114, "high": 316, "med": 321, "low": 195, "info": 476, "unk": 180, "note": ""}, {"name": "es56", "image": "elasticsearch:5.6", "ip": "172.31.1.65", "category": "Databases", "n": 2289, "crit": 128, "high": 513, "med": 589, "low": 354, "info": 505, "unk": 200, "note": ""}, {"name": "mongodb-noauth", "image": "mongo:3.4", "ip": "172.30.14.3", "category": "Databases", "n": 1036, "crit": 0, "high": 17, "med": 209, "low": 260, "info": 230, "unk": 320, "note": ""}, {"name": "mysql-old", "image": "mysql:5.5", "ip": "172.30.14.1", "category": "Databases", "n": 1118, "crit": 42, "high": 235, "med": 440, "low": 162, "info": 196, "unk": 43, "note": ""}, {"name": "redis-noauth", "image": "redis:4.0", "ip": "172.30.14.4", "category": "Databases", "n": 524, "crit": 16, "high": 89, "med": 76, "low": 31, "info": 148, "unk": 164, "note": ""}, {"name": "postgres-old", "image": "postgres:9.4", "ip": "172.30.14.2", "category": "Databases", "n": 1371, "crit": 149, "high": 452, "med": 253, "low": 129, "info": 318, "unk": 70, "note": ""}, {"name": "pg95", "image": "postgres:9.5", "ip": "172.31.1.29", "category": "Databases", "n": 963, "crit": 60, "high": 198, "med": 170, "low": 127, "info": 255, "unk": 153, "note": ""}, {"name": "pg93", "image": "postgres:9.3", "ip": "172.31.1.28", "category": "Databases", "n": 1225, "crit": 157, "high": 313, "med": 257, "low": 84, "info": 330, "unk": 84, "note": ""}, {"name": "mysql56", "image": "mysql:5.6", "ip": "172.31.1.26", "category": "Databases", "n": 739, "crit": 38, "high": 159, "med": 100, "low": 103, "info": 204, "unk": 135, "note": ""}, {"name": "redis32", "image": "redis:3.2", "ip": "172.31.1.32", "category": "Databases", "n": 584, "crit": 58, "high": 152, "med": 77, "low": 110, "info": 151, "unk": 36, "note": ""}, {"name": "redis50", "image": "redis:5.0", "ip": "172.31.1.33", "category": "Databases", "n": 1252, "crit": 37, "high": 295, "med": 356, "low": 135, "info": 177, "unk": 252, "note": ""}, {"name": "gogs011", "image": "gogs/gogs:0.11", "ip": "172.31.1.56", "category": "DevOps and CI/CD", "n": 397, "crit": 92, "high": 107, "med": 100, "low": 15, "info": 32, "unk": 51, "note": ""}, {"name": "docker-registry-noauth", "image": "registry:2", "ip": "172.30.21.1", "category": "DevOps and CI/CD", "n": 164, "crit": 7, "high": 49, "med": 75, "low": 11, "info": 18, "unk": 4, "note": ""}, {"name": "gitea14", "image": "gitea/gitea:1.4.0", "ip": "172.31.1.57", "category": "DevOps and CI/CD", "n": 382, "crit": 72, "high": 107, "med": 105, "low": 14, "info": 42, "unk": 42, "note": ""}, {"name": "jenkins260", "image": "jenkins/jenkins:2.60", "ip": "172.31.1.48", "category": "DevOps and CI/CD", "n": 3364, "crit": 268, "high": 628, "med": 846, "low": 317, "info": 816, "unk": 489, "note": ""}, {"name": "jenkins2150", "image": "jenkins/jenkins:2.150", "ip": "172.31.1.49", "category": "DevOps and CI/CD", "n": 3992, "crit": 273, "high": 857, "med": 1096, "low": 567, "info": 779, "unk": 420, "note": ""}, {"name": "nexus2", "image": "sonatype/nexus:2.14.4", "ip": "172.31.1.50", "category": "DevOps and CI/CD", "n": 3000, "crit": 79, "high": 295, "med": 1150, "low": 853, "info": 481, "unk": 142, "note": ""}, {"name": "artifactory5", "image": "docker.bintray.io/jfrog/artifactory-oss:5.11.0", "ip": "172.31.1.54", "category": "DevOps and CI/CD", "n": 6171, "crit": 603, "high": 1770, "med": 1589, "low": 665, "info": 981, "unk": 563, "note": ""}, {"name": "sonar70", "image": "sonarqube:7.0", "ip": "172.31.1.53", "category": "DevOps and CI/CD", "n": 4868, "crit": 393, "high": 1101, "med": 1261, "low": 644, "info": 966, "unk": 503, "note": ""}, {"name": "express-old", "image": "node:6.14", "ip": "172.30.22.2", "category": "Languages and Runtimes", "n": 6664, "crit": 358, "high": 1308, "med": 1599, "low": 520, "info": 2705, "unk": 174, "note": ""}, {"name": "sonar67", "image": "sonarqube:6.7", "ip": "172.31.1.52", "category": "DevOps and CI/CD", "n": 5238, "crit": 411, "high": 1219, "med": 1417, "low": 663, "info": 969, "unk": 559, "note": ""}, {"name": "node8", "image": "node:8", "ip": "172.31.1.40", "category": "Languages and Runtimes", "n": 6369, "crit": 296, "high": 1139, "med": 1424, "low": 498, "info": 2874, "unk": 138, "note": ""}, {"name": "go19", "image": "golang:1.9", "ip": "172.31.1.46", "category": "Languages and Runtimes", "n": 2799, "crit": 270, "high": 874, "med": 741, "low": 352, "info": 435, "unk": 127, "note": ""}, {"name": "node6", "image": "node:6", "ip": "172.31.1.39", "category": "Languages and Runtimes", "n": 9891, "crit": 556, "high": 2412, "med": 2976, "low": 1070, "info": 2709, "unk": 168, "note": ""}, {"name": "php70", "image": "php:7.0-apache", "ip": "172.31.1.45", "category": "Languages and Runtimes", "n": 2583, "crit": 244, "high": 850, "med": 639, "low": 331, "info": 412, "unk": 107, "note": ""}, {"name": "node10", "image": "node:10", "ip": "172.31.1.41", "category": "Languages and Runtimes", "n": 5447, "crit": 222, "high": 911, "med": 894, "low": 455, "info": 2881, "unk": 84, "note": ""}, {"name": "mediawiki128", "image": "mediawiki:1.28", "ip": "172.31.1.94", "category": "CMS and Web Platforms", "n": 4812, "crit": 191, "high": 959, "med": 1755, "low": 546, "info": 1186, "unk": 175, "note": ""}, {"name": "python36", "image": "python:3.6", "ip": "172.31.1.38", "category": "Languages and Runtimes", "n": 6287, "crit": 291, "high": 1371, "med": 1520, "low": 202, "info": 1586, "unk": 1317, "note": ""}, {"name": "python35", "image": "python:3.5", "ip": "172.31.1.37", "category": "Languages and Runtimes", "n": 8123, "crit": 301, "high": 2282, "med": 3001, "low": 874, "info": 1440, "unk": 225, "note": ""}, {"name": "gitlab10", "image": "gitlab/gitlab-ce:10.0.0-ce.0", "ip": "172.31.1.55", "category": "CMS and Web Platforms", "n": 4688, "crit": 42, "high": 323, "med": 1677, "low": 900, "info": 707, "unk": 1039, "note": ""}, {"name": "kafka-old", "image": "wurstmeister/kafka:2.11-0.10.2.2", "ip": "172.30.47.1", "category": "Messaging and Streaming", "n": 1694, "crit": 52, "high": 212, "med": 157, "low": 27, "info": 182, "unk": 1064, "note": ""}, {"name": "activemq-old", "image": "rmohr/activemq:5.14.3", "ip": "172.30.20.2", "category": "Messaging and Streaming", "n": 2031, "crit": 164, "high": 534, "med": 395, "low": 208, "info": 445, "unk": 285, "note": ""}, {"name": "rabbit36", "image": "rabbitmq:3.6-management", "ip": "172.31.1.58", "category": "Messaging and Streaming", "n": 1200, "crit": 112, "high": 310, "med": 233, "low": 159, "info": 307, "unk": 79, "note": ""}, {"name": "rabbit37", "image": "rabbitmq:3.7-management", "ip": "172.31.1.59", "category": "Messaging and Streaming", "n": 1255, "crit": 5, "high": 45, "med": 370, "low": 245, "info": 165, "unk": 425, "note": ""}, {"name": "zookeeper-old", "image": "zookeeper:3.4", "ip": "172.30.46.1", "category": "Messaging and Streaming", "n": 1150, "crit": 87, "high": 239, "med": 291, "low": 90, "info": 324, "unk": 119, "note": ""}, {"name": "grafana-old", "image": "grafana/grafana:5.1.0", "ip": "172.30.19.2", "category": "Monitoring and Logging", "n": 1189, "crit": 133, "high": 353, "med": 222, "low": 155, "info": 228, "unk": 98, "note": ""}, {"name": "influx13", "image": "influxdb:1.3", "ip": "172.31.1.73", "category": "Monitoring and Logging", "n": 1249, "crit": 126, "high": 385, "med": 236, "low": 168, "info": 228, "unk": 106, "note": ""}, {"name": "nextcloud12", "image": "nextcloud:12", "ip": "172.31.1.93", "category": "CMS and Web Platforms", "n": 1656, "crit": 196, "high": 443, "med": 253, "low": 148, "info": 503, "unk": 113, "note": ""}, {"name": "mediawiki-old", "image": "mediawiki:1.27", "ip": "172.30.32.1", "category": "CMS and Web Platforms", "n": 6134, "crit": 326, "high": 1835, "med": 2260, "low": 462, "info": 1069, "unk": 182, "note": ""}, {"name": "kafka011", "image": "wurstmeister/kafka:2.11-0.11.0.3", "ip": "172.31.1.60", "category": "Messaging and Streaming", "n": 1702, "crit": 52, "high": 213, "med": 159, "low": 27, "info": 185, "unk": 1066, "note": ""}, {"name": "kibana-old", "image": "kibana:4.6", "ip": "172.30.19.1", "category": "Monitoring and Logging", "n": 2319, "crit": 36, "high": 386, "med": 511, "low": 187, "info": 1149, "unk": 50, "note": ""}, {"name": "kibana56", "image": "kibana:5.6", "ip": "172.31.1.68", "category": "Monitoring and Logging", "n": 2125, "crit": 41, "high": 241, "med": 250, "low": 96, "info": 1467, "unk": 30, "note": ""}, {"name": "zabbix40", "image": "zabbix/zabbix-server-mysql:ubuntu-4.0-latest", "ip": "172.31.1.75", "category": "Monitoring and Logging", "n": 1176, "crit": 0, "high": 4, "med": 370, "low": 102, "info": 187, "unk": 513, "note": ""}, {"name": "ruby23", "image": "ruby:2.3", "ip": "172.31.1.42", "category": "Languages and Runtimes", "n": 6048, "crit": 309, "high": 1169, "med": 1462, "low": 498, "info": 2451, "unk": 159, "note": ""}, {"name": "ruby24", "image": "ruby:2.4", "ip": "172.31.1.43", "category": "Languages and Runtimes", "n": 4874, "crit": 171, "high": 1249, "med": 1449, "low": 413, "info": 1420, "unk": 172, "note": ""}, {"name": "adminer", "image": "adminer:4.2", "ip": "172.30.26.2", "category": "Network and Infrastructure", "n": 604, "crit": 98, "high": 192, "med": 191, "low": 24, "info": 39, "unk": 60, "note": ""}, {"name": "asterisk", "image": "andrius/asterisk:latest", "ip": "172.30.28.1", "category": "Network and Infrastructure", "n": 1928, "crit": 5, "high": 76, "med": 290, "low": 596, "info": 723, "unk": 238, "note": ""}, {"name": "consul-old", "image": "consul:0.9.0", "ip": "172.30.48.1", "category": "Network and Infrastructure", "n": 220, "crit": 73, "high": 55, "med": 41, "low": 9, "info": 17, "unk": 25, "note": ""}, {"name": "prometheus-old", "image": "prom/prometheus:v2.15.2", "ip": "172.31.1.72", "category": "Monitoring and Logging", "n": 1027, "crit": 43, "high": 356, "med": 315, "low": 18, "info": 167, "unk": 128, "note": ""}, {"name": "logstash56", "image": "logstash:5.6", "ip": "172.31.1.69", "category": "Monitoring and Logging", "n": 2446, "crit": 154, "high": 468, "med": 410, "low": 195, "info": 821, "unk": 398, "note": ""}, {"name": "dovecot", "image": "dovecot/dovecot:latest", "ip": "172.31.1.100", "category": "Network and Infrastructure", "n": 401, "crit": 1, "high": 19, "med": 89, "low": 76, "info": 158, "unk": 58, "note": ""}, {"name": "mailcatcher", "image": "schickling/mailcatcher:latest", "ip": "172.30.17.1", "category": "Network and Infrastructure", "n": 276, "crit": 10, "high": 59, "med": 73, "low": 13, "info": 105, "unk": 16, "note": ""}, {"name": "memcached-old", "image": "memcached:1.4", "ip": "172.30.25.1", "category": "Network and Infrastructure", "n": 744, "crit": 79, "high": 218, "med": 135, "low": 106, "info": 155, "unk": 51, "note": ""}, {"name": "dns-vuln", "image": "infosecwarrior/dns-lab:v2", "ip": "172.30.5.1", "category": "Network and Infrastructure", "n": 6923, "crit": 39, "high": 196, "med": 4013, "low": 2354, "info": 321, "unk": 0, "note": ""}, {"name": "bind", "image": "sameersbn/bind:9.11.3-20190706", "ip": "172.31.1.101", "category": "Network and Infrastructure", "n": 2756, "crit": 0, "high": 31, "med": 1282, "low": 455, "info": 264, "unk": 724, "note": ""}, {"name": "memcached15", "image": "memcached:1.5", "ip": "172.31.1.103", "category": "Network and Infrastructure", "n": 638, "crit": 33, "high": 175, "med": 171, "low": 44, "info": 152, "unk": 63, "note": ""}, {"name": "nagios", "image": "jasonrivers/nagios:latest", "ip": "172.31.1.74", "category": "Monitoring and Logging", "n": 3330, "crit": 0, "high": 20, "med": 1552, "low": 362, "info": 613, "unk": 783, "note": ""}, {"name": "phpmyadmin-old", "image": "phpmyadmin/phpmyadmin:4.6", "ip": "172.30.26.1", "category": "Network and Infrastructure", "n": 1073, "crit": 262, "high": 199, "med": 419, "low": 25, "info": 67, "unk": 101, "note": ""}, {"name": "proftpd-vuln", "image": "infosecwarrior/ftp:v1", "ip": "172.30.2.2", "category": "Network and Infrastructure", "n": 4630, "crit": 90, "high": 854, "med": 880, "low": 987, "info": 1096, "unk": 723, "note": ""}, {"name": "ubuntu-sshd-old", "image": "rastasheep/ubuntu-sshd:14.04", "ip": "172.30.3.2", "category": "Network and Infrastructure", "n": 3214, "crit": 0, "high": 43, "med": 1081, "low": 629, "info": 450, "unk": 1011, "note": ""}, {"name": "openssh", "image": "linuxserver/openssh-server:latest", "ip": "172.31.1.96", "category": "Network and Infrastructure", "n": 86, "crit": 0, "high": 3, "med": 16, "low": 4, "info": 63, "unk": 0, "note": ""}, {"name": "vault-old", "image": "vault:0.9.0", "ip": "172.30.49.1", "category": "Network and Infrastructure", "n": 41, "crit": 4, "high": 15, "med": 5, "low": 4, "info": 13, "unk": 0, "note": ""}, {"name": "heartbleed-lab", "image": "vulnerables/cve-2014-0160:latest", "ip": "172.30.40.8", "category": "Specific CVEs", "n": 666, "crit": 5, "high": 108, "med": 225, "low": 67, "info": 231, "unk": 30, "note": ""}, {"name": "vsftpd", "image": "fauria/vsftpd:latest", "ip": "172.31.1.97", "category": "Network and Infrastructure", "n": 2950, "crit": 4, "high": 100, "med": 1325, "low": 1348, "info": 173, "unk": 0, "note": ""}, {"name": "log4shell", "image": "ghcr.io/christophetd/log4shell-vulnerable-app:latest", "ip": "172.30.6.4", "category": "Specific CVEs", "n": 1014, "crit": 42, "high": 185, "med": 354, "low": 276, "info": 104, "unk": 53, "note": ""}, {"name": "phpldapadmin", "image": "osixia/phpldapadmin:0.7.1", "ip": "172.30.29.2", "category": "Network and Infrastructure", "n": 3367, "crit": 607, "high": 1175, "med": 814, "low": 207, "info": 408, "unk": 156, "note": ""}, {"name": "pma48", "image": "phpmyadmin/phpmyadmin:4.8", "ip": "172.31.1.89", "category": "Network and Infrastructure", "n": 587, "crit": 81, "high": 175, "med": 166, "low": 28, "info": 97, "unk": 40, "note": ""}, {"name": "shellshock-lab", "image": "vulnerables/cve-2014-6271:latest", "ip": "172.30.40.7", "category": "Specific CVEs", "n": 766, "crit": 52, "high": 164, "med": 189, "low": 108, "info": 231, "unk": 22, "note": ""}, {"name": "apache-cve-2021-41773", "image": "httpd:2.4.49", "ip": "172.30.6.3", "category": "Specific CVEs", "n": 846, "crit": 59, "high": 237, "med": 228, "low": 54, "info": 195, "unk": 73, "note": ""}, {"name": "snmpd", "image": "polinux/snmpd:latest", "ip": "172.30.30.1", "category": "Network and Infrastructure", "n": 2243, "crit": 8, "high": 141, "med": 1078, "low": 812, "info": 204, "unk": 0, "note": ""}, {"name": "solr-old", "image": "solr:6.6", "ip": "172.30.45.1", "category": "Network and Infrastructure", "n": 3067, "crit": 223, "high": 626, "med": 651, "low": 250, "info": 502, "unk": 815, "note": ""}, {"name": "bwapp", "image": "raesene/bwapp:latest", "ip": "172.30.9.2", "category": "Vulnerable Web Applications", "n": 13162, "crit": 0, "high": 117, "med": 7973, "low": 1834, "info": 530, "unk": 2708, "note": ""}, {"name": "sambacry", "image": "vulnerables/cve-2017-7494:latest", "ip": "172.30.4.1", "category": "Specific CVEs", "n": 3127, "crit": 126, "high": 585, "med": 1182, "low": 431, "info": 651, "unk": 152, "note": ""}, {"name": "ssh-cve-2016-6515", "image": "vulnerables/cve-2016-6515:latest", "ip": "172.30.3.1", "category": "Specific CVEs", "n": 2564, "crit": 0, "high": 55, "med": 821, "low": 629, "info": 326, "unk": 733, "note": ""}, {"name": "dvwa", "image": "vulnerables/web-dvwa:latest", "ip": "172.30.9.1", "category": "Vulnerable Web Applications", "n": 2456, "crit": 327, "high": 760, "med": 706, "low": 102, "info": 431, "unk": 130, "note": ""}, {"name": "dvna", "image": "appsecco/dvna:latest", "ip": "172.31.1.104", "category": "Vulnerable Web Applications", "n": 10182, "crit": 329, "high": 1930, "med": 3604, "low": 993, "info": 3084, "unk": 242, "note": ""}, {"name": "dsvw", "image": "appsecco/dsvw:latest", "ip": "172.30.40.1", "category": "Vulnerable Web Applications", "n": 327, "crit": 28, "high": 100, "med": 113, "low": 10, "info": 30, "unk": 46, "note": ""}, {"name": "tomcat-ghostcat", "image": "vulhub/tomcat:9.0.30", "ip": "172.30.44.2", "category": "Specific CVEs", "n": 2027, "crit": 122, "high": 636, "med": 547, "low": 151, "info": 450, "unk": 121, "note": ""}, {"name": "echo-server", "image": "jmalloc/echo-server:latest", "ip": "172.30.50.3", "category": "Vulnerable Web Applications", "n": 152, "crit": 6, "high": 50, "med": 78, "low": 5, "info": 5, "unk": 8, "note": ""}, {"name": "metasploit-emulator", "image": "vulnerables/metasploit-vulnerability-emulator:latest", "ip": "172.30.40.6", "category": "Vulnerable Web Applications", "n": 795, "crit": 105, "high": 221, "med": 117, "low": 118, "info": 177, "unk": 57, "note": ""}, {"name": "httpbin", "image": "kennethreitz/httpbin:latest", "ip": "172.30.50.1", "category": "Vulnerable Web Applications", "n": 5615, "crit": 6, "high": 135, "med": 2766, "low": 1335, "info": 384, "unk": 989, "note": ""}, {"name": "hackazon", "image": "ianwijaya/hackazon:latest", "ip": "172.30.7.2", "category": "Vulnerable Web Applications", "n": 14934, "crit": 2, "high": 119, "med": 8475, "low": 2219, "info": 781, "unk": 3338, "note": ""}, {"name": "bwapp-alt", "image": "hackersploit/bwapp-docker:latest", "ip": "172.30.9.4", "category": "Vulnerable Web Applications", "n": 13162, "crit": 0, "high": 117, "med": 7973, "low": 1834, "info": 530, "unk": 2708, "note": ""}, {"name": "juice-shop", "image": "bkimminich/juice-shop:latest", "ip": "172.30.7.1", "category": "Vulnerable Web Applications", "n": 1390, "crit": 24, "high": 47, "med": 59, "low": 6, "info": 1159, "unk": 95, "note": ""}, {"name": "damn-vulnerable-graphql", "image": "dolevf/dvga:latest", "ip": "172.30.10.4", "category": "Vulnerable Web Applications", "n": 3896, "crit": 191, "high": 712, "med": 793, "low": 119, "info": 1402, "unk": 679, "note": ""}, {"name": "mutillidae", "image": "citizenstig/nowasp:latest", "ip": "172.30.9.3", "category": "Vulnerable Web Applications", "n": 10340, "crit": 0, "high": 75, "med": 6342, "low": 1146, "info": 553, "unk": 2224, "note": ""}, {"name": "phpldapadmin-remote-dump", "image": "vulnerables/phpldapadmin-remote-dump:latest", "ip": "172.30.40.5", "category": "Vulnerable Web Applications", "n": 2395, "crit": 130, "high": 398, "med": 838, "low": 203, "info": 702, "unk": 124, "note": ""}, {"name": "metasploitable3-alt", "image": "heywoodlh/vulnerable:latest", "ip": "172.30.1.4", "category": "Vulnerable Web Applications", "n": 16272, "crit": 151, "high": 479, "med": 8906, "low": 2031, "info": 1836, "unk": 2869, "note": ""}, {"name": "security-shepherd", "image": "ismisepaul/securityshepherd:latest", "ip": "172.30.8.4", "category": "Vulnerable Web Applications", "n": 2257, "crit": 116, "high": 668, "med": 620, "low": 158, "info": 542, "unk": 153, "note": ""}, {"name": "ssrflab", "image": "youyouorz/ssrf-vulnerable-lab:latest", "ip": "172.31.1.106", "category": "Vulnerable Web Applications", "n": 2691, "crit": 248, "high": 886, "med": 663, "low": 334, "info": 451, "unk": 109, "note": ""}, {"name": "vampi", "image": "erev0s/vampi:latest", "ip": "172.30.10.2", "category": "Vulnerable Web Applications", "n": 249, "crit": 5, "high": 45, "med": 54, "low": 11, "info": 98, "unk": 36, "note": ""}, {"name": "webgoat", "image": "webgoat/webgoat:latest", "ip": "172.30.8.1", "category": "Vulnerable Web Applications", "n": 1819, "crit": 14, "high": 101, "med": 886, "low": 231, "info": 318, "unk": 269, "note": ""}, {"name": "railsgoat-alt", "image": "vulnerables/web-owasp-railsgoat:latest", "ip": "172.30.8.5", "category": "Vulnerable Web Applications", "n": 9256, "crit": 287, "high": 1760, "med": 3563, "low": 943, "info": 2453, "unk": 250, "note": ""}, {"name": "wackopicko", "image": "adamdoupe/wackopicko:latest", "ip": "172.30.39.1", "category": "Vulnerable Web Applications", "n": 12159, "crit": 0, "high": 95, "med": 6737, "low": 1633, "info": 706, "unk": 2988, "note": ""}, {"name": "xvwa", "image": "marcositu/xvwa2020:latest", "ip": "172.30.40.9", "category": "Vulnerable Web Applications", "n": 9631, "crit": 0, "high": 63, "med": 6705, "low": 1012, "info": 287, "unk": 1564, "note": ""}, {"name": "caddy20", "image": "caddy:2.0.0", "ip": "172.31.1.15", "category": "Web and Application Servers", "n": 692, "crit": 37, "high": 258, "med": 203, "low": 19, "info": 93, "unk": 82, "note": ""}, {"name": "apache246", "image": "httpd:2.4.25", "ip": "172.31.1.10", "category": "Web and Application Servers", "n": 1482, "crit": 60, "high": 369, "med": 549, "low": 176, "info": 262, "unk": 66, "note": ""}, {"name": "haproxy15", "image": "haproxy:1.5", "ip": "172.31.1.76", "category": "Web and Application Servers", "n": 467, "crit": 35, "high": 104, "med": 56, "low": 85, "info": 152, "unk": 35, "note": ""}, {"name": "glassfish41", "image": "glassfish:4.1", "ip": "172.31.1.24", "category": "Web and Application Servers", "n": 3619, "crit": 221, "high": 687, "med": 1094, "low": 255, "info": 1038, "unk": 324, "note": ""}, {"name": "metasploitable2", "image": "tleemcjr/metasploitable2:latest", "ip": "172.30.1.1", "category": "Vulnerable Web Applications", "n": 4454, "crit": 37, "high": 932, "med": 2560, "low": 201, "info": 702, "unk": 22, "note": ""}, {"name": "haproxy16", "image": "haproxy:1.6", "ip": "172.31.1.77", "category": "Web and Application Servers", "n": 363, "crit": 29, "high": 66, "med": 38, "low": 50, "info": 153, "unk": 27, "note": ""}, {"name": "haproxy17", "image": "haproxy:1.7", "ip": "172.31.1.78", "category": "Web and Application Servers", "n": 557, "crit": 26, "high": 142, "med": 147, "low": 44, "info": 150, "unk": 48, "note": ""}, {"name": "lighttpd", "image": "sebp/lighttpd:latest", "ip": "172.31.1.14", "category": "Web and Application Servers", "n": 165, "crit": 10, "high": 52, "med": 54, "low": 6, "info": 24, "unk": 19, "note": ""}, {"name": "nginx-old", "image": "nginx:1.10", "ip": "172.30.15.1", "category": "Web and Application Servers", "n": 1253, "crit": 54, "high": 256, "med": 443, "low": 139, "info": 261, "unk": 100, "note": ""}, {"name": "nginx112", "image": "nginx:1.12", "ip": "172.31.1.12", "category": "Web and Application Servers", "n": 940, "crit": 115, "high": 245, "med": 168, "low": 128, "info": 211, "unk": 73, "note": ""}, {"name": "nginx114", "image": "nginx:1.14", "ip": "172.31.1.13", "category": "Web and Application Servers", "n": 781, "crit": 86, "high": 185, "med": 141, "low": 98, "info": 211, "unk": 60, "note": ""}, {"name": "squid-old", "image": "sameersbn/squid:3.3.8-23", "ip": "172.30.18.1", "category": "Web and Application Servers", "n": 3613, "crit": 0, "high": 54, "med": 1208, "low": 795, "info": 408, "unk": 1148, "note": ""}, {"name": "squid35", "image": "sameersbn/squid:3.5.27-2", "ip": "172.31.1.79", "category": "Web and Application Servers", "n": 1573, "crit": 0, "high": 20, "med": 478, "low": 241, "info": 215, "unk": 619, "note": ""}, {"name": "apache-old", "image": "httpd:2.2", "ip": "172.30.15.2", "category": "Web and Application Servers", "n": 1194, "crit": 30, "high": 272, "med": 397, "low": 174, "info": 259, "unk": 62, "note": ""}, {"name": "sqli", "image": "acgpiano/sqli-labs:latest", "ip": "172.31.1.107", "category": "Vulnerable Web Applications", "n": 11754, "crit": 0, "high": 89, "med": 6958, "low": 1368, "info": 532, "unk": 2807, "note": ""}, {"name": "railsgoat", "image": "owasp/railsgoat:latest", "ip": "172.30.8.3", "category": "Vulnerable Web Applications", "n": 5316, "crit": 184, "high": 1315, "med": 1610, "low": 430, "info": 1602, "unk": 175, "note": ""}, {"name": "tomcat7", "image": "tomcat:7.0.70", "ip": "172.31.1.17", "category": "Web and Application Servers", "n": 1421, "crit": 1, "high": 165, "med": 559, "low": 133, "info": 404, "unk": 159, "note": ""}, {"name": "tomcat6", "image": "tomcat:6", "ip": "172.31.1.16", "category": "Web and Application Servers", "n": 1874, "crit": 99, "high": 321, "med": 679, "low": 220, "info": 399, "unk": 156, "note": ""}, {"name": "traefik15", "image": "traefik:1.5", "ip": "172.31.1.80", "category": "Web and Application Servers", "n": 37, "crit": 5, "high": 15, "med": 12, "low": 4, "info": 1, "unk": 0, "note": ""}, {"name": "metasploitable3", "image": "kirscht/metasploitable3-ub1404:latest", "ip": "172.30.1.3", "category": "Vulnerable Web Applications", "n": 34337, "crit": 168, "high": 1125, "med": 23036, "low": 3618, "info": 2591, "unk": 3799, "note": ""}, {"name": "tomcat8", "image": "tomcat:8.0", "ip": "172.31.1.18", "category": "Web and Application Servers", "n": 1631, "crit": 41, "high": 231, "med": 523, "low": 240, "info": 463, "unk": 133, "note": ""}, {"name": "jboss7", "image": "jboss/wildfly:8.2.1.Final", "ip": "172.31.1.20", "category": "Web and Application Servers", "n": 5933, "crit": 74, "high": 552, "med": 2575, "low": 1850, "info": 684, "unk": 198, "note": ""}, {"name": "wildfly10", "image": "jboss/wildfly:10.1.0.Final", "ip": "172.31.1.22", "category": "Web and Application Servers", "n": 3500, "crit": 41, "high": 295, "med": 1261, "low": 925, "info": 750, "unk": 228, "note": ""}, {"name": "wildfly9", "image": "jboss/wildfly:9.0.2.Final", "ip": "172.31.1.21", "category": "Web and Application Servers", "n": 6120, "crit": 86, "high": 592, "med": 2612, "low": 1852, "info": 735, "unk": 243, "note": ""}, {"name": "tomcat7-vuln", "image": "tomcat:7.0.94", "ip": "172.30.44.1", "category": "Web and Application Servers", "n": 1212, "crit": 80, "high": 239, "med": 261, "low": 131, "info": 410, "unk": 91, "note": ""}, {"name": "php56", "image": "php:5.6-apache", "ip": "172.31.1.44", "category": "Languages and Runtimes", "n": 2541, "crit": 236, "high": 830, "med": 639, "low": 323, "info": 411, "unk": 102, "note": ""}, {"name": "python27", "image": "python:2.7", "ip": "172.31.1.36", "category": "Languages and Runtimes", "n": 9426, "crit": 354, "high": 2889, "med": 3587, "low": 880, "info": 1459, "unk": 257, "note": ""}], "findings": [{"sev": "critical", "id": "CVE-2023-46604", "cvss": 10.0, "title": "activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "cat": "pkg-vuln", "pkg": "org.apache.activemq:activemq-client", "ver": "5.14.3", "fix": "5.15.16, 5.16.7, 5.17.6, 5.18.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2023-46604", "cvss": 10.0, "title": "activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "cat": "pkg-vuln", "pkg": "org.apache.activemq:activemq-client", "ver": "5.14.3", "fix": "5.15.16, 5.16.7, 5.17.6, 5.18.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2023-46604", "cvss": 10.0, "title": "activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "cat": "pkg-vuln", "pkg": "org.apache.activemq:activemq-openwire-legacy", "ver": "5.14.3", "fix": "5.15.16, 5.16.7, 5.17.6, 5.18.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2023-46604", "cvss": 10.0, "title": "activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack", "cat": "pkg-vuln", "pkg": "org.apache.activemq:activemq-openwire-legacy", "ver": "5.14.3", "fix": "5.15.16, 5.16.7, 5.17.6, 5.18.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-crg9-44h2-xw35", "cvss": 10.0, "title": "GHSA-crg9-44h2-xw35", "cat": "pkg-vuln", "pkg": "activemq-client", "ver": "5.14.3", "fix": "5.15.16", "target": "activemq-old", "ip": "172.30.20.2", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-crg9-44h2-xw35", "cvss": 10.0, "title": "GHSA-crg9-44h2-xw35", "cat": "pkg-vuln", "pkg": "activemq-client", "ver": "5.14.3", "fix": "5.15.16", "target": "activemq-old", "ip": "172.30.20.2", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-crg9-44h2-xw35", "cvss": 10.0, "title": "GHSA-crg9-44h2-xw35", "cat": "pkg-vuln", "pkg": "activemq-openwire-legacy", "ver": "5.14.3", "fix": "5.15.16", "target": "activemq-old", "ip": "172.30.20.2", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-crg9-44h2-xw35", "cvss": 10.0, "title": "GHSA-crg9-44h2-xw35", "cat": "pkg-vuln", "pkg": "activemq-openwire-legacy", "ver": "5.14.3", "fix": "5.15.16", "target": "activemq-old", "ip": "172.30.20.2", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2017-18017", "cvss": 10.0, "title": "kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.51-2", "fix": "3.16.56-1", "target": "apache-old", "ip": "172.30.15.2", "by": ["trivy"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.51-2", "fix": "3.16.81-1", "target": "apache-old", "ip": "172.30.15.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.51-2", "fix": "3.16.81-1", "target": "apache-old", "ip": "172.30.15.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.51-2", "fix": "3.16.81-1", "target": "apache-old", "ip": "172.30.15.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "apache-old", "ip": "172.30.15.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u4", "fix": "", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-18017", "cvss": 10.0, "title": "kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u1", "fix": "3.16.56-1", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901"}, {"sev": "critical", "id": "CVE-2017-7376", "cvss": 10.0, "title": "libxml2: Incorrect limit used for port values", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u4", "fix": "2.9.1+dfsg1-5+deb8u5", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/98877"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u1", "fix": "3.16.81-1", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u1", "fix": "3.16.81-1", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u1", "fix": "3.16.81-1", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "apache246", "ip": "172.31.1.10", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5", "fix": "7.52.1-5+deb9u7", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5", "fix": "7.52.1-5+deb9u7", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.52.1-5", "fix": "7.52.1-5+deb9u7", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14721", "cvss": 10.0, "title": "jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.8.6", "fix": "2.9.7, 2.8.11.3, 2.7.9.5", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "CVE-2018-14721", "cvss": 10.0, "title": "jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.9.2", "fix": "2.9.7, 2.8.11.3, 2.7.9.5", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26.2-1.1", "fix": "2:3.26.2-1.1+deb9u2", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.4-2+b1", "fix": "2:1.9.4-2+deb9u1", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2024-1597", "cvss": 10.0, "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "cat": "pkg-vuln", "pkg": "org.postgresql:postgresql", "ver": "9.4.1212", "fix": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/04/02/6"}, {"sev": "critical", "id": "CVE-2024-1597", "cvss": 10.0, "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "cat": "pkg-vuln", "pkg": "org.postgresql:postgresql", "ver": "9.4.1212", "fix": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "target": "artifactory5", "ip": "172.31.1.54", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/04/02/6"}, {"sev": "critical", "id": "GHSA-24rp-q3w6-vc56", "cvss": 10.0, "title": "GHSA-24rp-q3w6-vc56", "cat": "pkg-vuln", "pkg": "postgresql", "ver": "9.4.1212", "fix": "42.2.28", "target": "artifactory5", "ip": "172.31.1.54", "by": ["grype"], "ref": "https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee"}, {"sev": "critical", "id": "GHSA-24rp-q3w6-vc56", "cvss": 10.0, "title": "GHSA-24rp-q3w6-vc56", "cat": "pkg-vuln", "pkg": "postgresql", "ver": "9.4.1212", "fix": "42.2.28", "target": "artifactory5", "ip": "172.31.1.54", "by": ["grype"], "ref": "https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.8.6", "fix": "2.8.11.3", "target": "artifactory5", "ip": "172.31.1.54", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.9.2", "fix": "2.9.7", "target": "artifactory5", "ip": "172.31.1.54", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "CVE-2025-44005", "cvss": 10.0, "title": "github.com/smallstep/certificates: github.com/smallstep/certificates: Authorization bypass allows unauthorized certificate creation", "cat": "pkg-vuln", "pkg": "github.com/smallstep/certificates", "ver": "v0.14.2", "fix": "0.29.0", "target": "caddy20", "ip": "172.31.1.15", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2025-44005"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.14.2", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "caddy20", "ip": "172.31.1.15", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.14.2", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "caddy20", "ip": "172.31.1.15", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2026-30836", "cvss": 10.0, "title": "github.com/smallstep/certificates: Step CA: Unauthenticated certificate issuance via SCEP Update Request", "cat": "pkg-vuln", "pkg": "github.com/smallstep/certificates", "ver": "v0.14.2", "fix": "0.30.0", "target": "caddy20", "ip": "172.31.1.15", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2026-30836"}, {"sev": "critical", "id": "GHSA-h8cp-697h-8c8p", "cvss": 10.0, "title": "GHSA-h8cp-697h-8c8p", "cat": "pkg-vuln", "pkg": "github.com/smallstep/certificates", "ver": "v0.14.2", "fix": "0.29.0", "target": "caddy20", "ip": "172.31.1.15", "by": ["grype"], "ref": "https://github.com/smallstep/certificates/commit/1011f5f5408b470a636f583bf74c0d7bbaf75d72"}, {"sev": "critical", "id": "GHSA-q4r8-xm5f-56gw", "cvss": 10.0, "title": "GHSA-q4r8-xm5f-56gw", "cat": "pkg-vuln", "pkg": "github.com/smallstep/certificates", "ver": "v0.14.2", "fix": "0.30.0", "target": "caddy20", "ip": "172.31.1.15", "by": ["grype"], "ref": "https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.13.10", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "cassandra22", "ip": "172.31.1.34", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.54.0-r0", "fix": "7.61.1-r0", "target": "consul-old", "ip": "172.30.48.1", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl", "ver": "7.54.0-r0", "fix": "7.61.1-r0", "target": "consul-old", "ip": "172.30.48.1", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.20.8", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "docker-registry-noauth", "ip": "172.30.21.1", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.20.8", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "docker-registry-noauth", "ip": "172.30.21.1", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.168-1", "fix": "4.9.210-1", "target": "drupal85", "ip": "172.31.1.85", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.168-1", "fix": "4.9.210-1", "target": "drupal85", "ip": "172.31.1.85", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.168-1", "fix": "4.9.210-1", "target": "drupal85", "ip": "172.31.1.85", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2-dev", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "3.1.2-2+deb8u4", "fix": "3.1.2-2+deb8u6", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "3.1.2-2+deb8u4", "fix": "3.1.2-2+deb8u6", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-18017", "cvss": 10.0, "title": "kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.56-1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u7", "fix": "7.38.0-4+deb8u12", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u7", "fix": "7.38.0-4+deb8u12", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.38.0-4+deb8u7", "fix": "7.38.0-4+deb8u12", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl4-openssl-dev", "ver": "7.38.0-4+deb8u7", "fix": "7.38.0-4+deb8u12", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2023-22578", "cvss": 10.0, "title": "Sequelize - Default support for “raw attributes” when using parentheses", "cat": "pkg-vuln", "pkg": "sequelize", "ver": "4.23.1", "fix": "6.29.0", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "https://csirt.divd.nl/CVE-2023-22578"}, {"sev": "critical", "id": "CVE-2023-22579", "cvss": 10.0, "title": "Unsafe fall-through in getWhereConditions", "cat": "pkg-vuln", "pkg": "sequelize", "ver": "4.23.1", "fix": "6.28.1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "https://csirt.divd.nl/CVE-2023-22579"}, {"sev": "critical", "id": "CVE-2023-25813", "cvss": 10.0, "title": "Sequelize vulnerable to SQL Injection via replacements", "cat": "pkg-vuln", "pkg": "sequelize", "ver": "4.23.1", "fix": "6.19.1", "target": "dvna", "ip": "172.31.1.104", "by": ["trivy"], "ref": "https://github.com/sequelize/sequelize"}, {"sev": "critical", "id": "GHSA-f598-mfpv-gmfx", "cvss": 10.0, "title": "GHSA-f598-mfpv-gmfx", "cat": "pkg-vuln", "pkg": "sequelize", "ver": "4.23.1", "fix": "6.29.0", "target": "dvna", "ip": "172.31.1.104", "by": ["grype"], "ref": "https://csirt.divd.nl/CVE-2023-22578"}, {"sev": "critical", "id": "GHSA-wrh9-cjv3-2hpw", "cvss": 10.0, "title": "GHSA-wrh9-cjv3-2hpw", "cat": "pkg-vuln", "pkg": "sequelize", "ver": "4.23.1", "fix": "6.19.1", "target": "dvna", "ip": "172.31.1.104", "by": ["grype"], "ref": "https://github.com/sequelize/sequelize/commit/ccaa3996047fe00048d5993ab2dd43ebadd4f78b"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.21.1", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "echo-server", "ip": "172.30.50.3", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.21.1", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "echo-server", "ip": "172.30.50.3", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26.2-1.1+deb9u1", "fix": "2:3.26.2-1.1+deb9u2", "target": "es56", "ip": "172.31.1.65", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2021-44228", "cvss": 10.0, "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "cat": "pkg-vuln", "pkg": "org.apache.logging.log4j:log4j-core", "ver": "2.11.1", "fix": "2.15.0, 2.3.1, 2.12.2", "target": "es56", "ip": "172.31.1.65", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.11.1", "fix": "2.12.2", "target": "es56", "ip": "172.31.1.65", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.59.0-r0", "fix": "7.61.1-r0", "target": "gitea14", "ip": "172.31.1.57", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl", "ver": "7.59.0-r0", "fix": "7.61.1-r0", "target": "gitea14", "ip": "172.31.1.57", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2022-30123", "cvss": 10.0, "title": "rubygem-rack: crafted requests can cause shell escape sequences", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.8", "fix": "~> 2.0.9, >= 2.0.9.1, ~> 2.1.4, >= 2.1.4.1, >= 2.2.3.1", "target": "gitlab10", "ip": "172.31.1.55", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2022-30123"}, {"sev": "critical", "id": "CVE-2024-45409", "cvss": 10.0, "title": "The Ruby SAML library is for implementing the client side of a SAML au ...", "cat": "pkg-vuln", "pkg": "omniauth-saml", "ver": "1.7.0", "fix": ">= 1.10.5, < 2.0.0, ~> 2.1.2, >= 2.2.1", "target": "gitlab10", "ip": "172.31.1.55", "by": ["trivy"], "ref": "https://github.com/SAML-Toolkits/ruby-saml"}, {"sev": "critical", "id": "CVE-2024-45409", "cvss": 10.0, "title": "The Ruby SAML library is for implementing the client side of a SAML au ...", "cat": "pkg-vuln", "pkg": "ruby-saml", "ver": "1.4.1", "fix": "~> 1.12.3, >= 1.17.0", "target": "gitlab10", "ip": "172.31.1.55", "by": ["trivy"], "ref": "https://github.com/SAML-Toolkits/ruby-saml"}, {"sev": "critical", "id": "GHSA-cvp8-5r8g-fhvq", "cvss": 10.0, "title": "omniauth-saml vulnerable to Improper Verification of Cryptographic Signature", "cat": "pkg-vuln", "pkg": "omniauth-saml", "ver": "1.7.0", "fix": "2.1.2, 1.10.5, 2.2.1", "target": "gitlab10", "ip": "172.31.1.55", "by": ["trivy"], "ref": "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2"}, {"sev": "critical", "id": "GHSA-cvp8-5r8g-fhvq", "cvss": 10.0, "title": "GHSA-cvp8-5r8g-fhvq", "cat": "pkg-vuln", "pkg": "omniauth-saml", "ver": "1.7.0", "fix": "1.10.5", "target": "gitlab10", "ip": "172.31.1.55", "by": ["grype"], "ref": "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2"}, {"sev": "critical", "id": "GHSA-jw9c-mfg7-9rx2", "cvss": 10.0, "title": "GHSA-jw9c-mfg7-9rx2", "cat": "pkg-vuln", "pkg": "ruby-saml", "ver": "1.4.1", "fix": "1.12.3", "target": "gitlab10", "ip": "172.31.1.55", "by": ["grype"], "ref": "https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.8", "fix": "2.0.9.1", "target": "gitlab10", "ip": "172.31.1.55", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u3", "fix": "", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2016-4658", "cvss": 10.0, "title": "libxml2: Use after free via namespace node in XPointer ranges", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u3", "fix": "2.9.1+dfsg1-5+deb8u4", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html"}, {"sev": "critical", "id": "CVE-2017-1000116", "cvss": 10.0, "title": "mercurial: command injection on clients through malicious ssh URLs", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "3.1.2-2+deb8u3", "fix": "3.1.2-2+deb8u4", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.debian.org/security/2017/dsa-3963"}, {"sev": "critical", "id": "CVE-2017-1000116", "cvss": 10.0, "title": "mercurial: command injection on clients through malicious ssh URLs", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "3.1.2-2+deb8u3", "fix": "3.1.2-2+deb8u4", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.debian.org/security/2017/dsa-3963"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "3.1.2-2+deb8u3", "fix": "3.1.2-2+deb8u6", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "3.1.2-2+deb8u3", "fix": "3.1.2-2+deb8u6", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-7376", "cvss": 10.0, "title": "libxml2: Incorrect limit used for port values", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u3", "fix": "2.9.1+dfsg1-5+deb8u5", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/98877"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u4", "fix": "7.38.0-4+deb8u12", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u4", "fix": "7.38.0-4+deb8u12", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.38.0-4+deb8u4", "fix": "7.38.0-4+deb8u12", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.17.2-1.1+deb8u2", "fix": "2:3.26-1+debu8u10", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "glassfish41", "ip": "172.31.1.24", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u6", "fix": "7.52.1-5+deb9u7", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u6", "fix": "7.52.1-5+deb9u7", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.52.1-5+deb9u6", "fix": "7.52.1-5+deb9u7", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.110-1", "fix": "4.9.210-1", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.110-1", "fix": "4.9.210-1", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.110-1", "fix": "4.9.210-1", "target": "go19", "ip": "172.31.1.46", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "go", "ver": "1.9.7", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "go19", "ip": "172.31.1.46", "by": ["grype"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-r2", "fix": "7.61.1-r0", "target": "gogs011", "ip": "172.31.1.56", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl", "ver": "7.52.1-r2", "fix": "7.61.1-r0", "target": "gogs011", "ip": "172.31.1.56", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u5", "fix": "7.52.1-5+deb9u7", "target": "grafana-old", "ip": "172.30.19.2", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u5", "fix": "7.52.1-5+deb9u7", "target": "grafana-old", "ip": "172.30.19.2", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2020-27846", "cvss": 10.0, "title": "CVE-2020-27846", "cat": "pkg-vuln", "pkg": "grafana", "ver": "5.1.0", "fix": "6.7.5, 7.2.3, 7.3.6", "target": "grafana-old", "ip": "172.30.19.2", "by": ["grype"], "ref": "https://bugzilla.redhat.com/show_bug.cgi?id=1907670"}, {"sev": "critical", "id": "CVE-2020-14343", "cvss": 10.0, "title": "PyYAML: incomplete fix for CVE-2020-1747", "cat": "pkg-vuln", "pkg": "PyYAML", "ver": "3.13", "fix": "5.4", "target": "httpbin", "ip": "172.30.50.1", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2020-14343"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u4", "fix": "7.52.1-5+deb9u7", "target": "influx13", "ip": "172.31.1.73", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u4", "fix": "7.52.1-5+deb9u7", "target": "influx13", "ip": "172.31.1.73", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.4-2+b1", "fix": "2:1.9.4-2+deb9u1", "target": "influx13", "ip": "172.31.1.73", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2015-7501", "cvss": 10.0, "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation", "cat": "pkg-vuln", "pkg": "commons-collections:commons-collections", "ver": "3.2.1", "fix": "3.2.2", "target": "jboss7", "ip": "172.31.1.20", "by": ["trivy"], "ref": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"}, {"sev": "critical", "id": "CVE-2021-42392", "cvss": 10.0, "title": "h2: Remote Code Execution in Console", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.173", "fix": "2.0.206", "target": "jboss7", "ip": "172.31.1.20", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2021-42392"}, {"sev": "critical", "id": "CVE-2022-23221", "cvss": 10.0, "title": "h2: Loading of custom classes from remote servers through JNDI", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.173", "fix": "2.1.210", "target": "jboss7", "ip": "172.31.1.20", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2018-1000861", "cvss": 10.0, "title": "jenkins: code execution through crafted URLs (SECURITY-595)", "cat": "pkg-vuln", "pkg": "org.jenkins-ci.main:jenkins-core", "ver": "2.150", "fix": "2.138.4, 2.154", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26.2-1.1+deb9u1", "fix": "2:3.26.2-1.1+deb9u2", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.110-3+deb9u6", "fix": "4.9.210-1", "target": "joomla38", "ip": "172.31.1.86", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.110-3+deb9u6", "fix": "4.9.210-1", "target": "joomla38", "ip": "172.31.1.86", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.110-3+deb9u6", "fix": "4.9.210-1", "target": "joomla38", "ip": "172.31.1.86", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "GHSA-47x8-96vw-5wg6", "cvss": 10.0, "title": "GHSA-47x8-96vw-5wg6", "cat": "pkg-vuln", "pkg": "vm2", "ver": "3.9.17", "fix": "3.11.0", "target": "juice-shop", "ip": "172.30.7.1", "by": ["grype"], "ref": "https://github.com/patriksimek/vm2/releases/tag/v3.11.0"}, {"sev": "critical", "id": "GHSA-qcp4-v2jj-fjx8", "cvss": 10.0, "title": "GHSA-qcp4-v2jj-fjx8", "cat": "pkg-vuln", "pkg": "vm2", "ver": "3.9.17", "fix": "3.11.0", "target": "juice-shop", "ip": "172.30.7.1", "by": ["grype"], "ref": "https://github.com/patriksimek/vm2/blob/408fc855f1cc1bbc2985b029465ee0e732ada433/lib/bridge.js#L655-L658"}, {"sev": "critical", "id": "GHSA-vwrp-x96c-mhwq", "cvss": 10.0, "title": "GHSA-vwrp-x96c-mhwq", "cat": "pkg-vuln", "pkg": "vm2", "ver": "3.9.17", "fix": "3.11.0", "target": "juice-shop", "ip": "172.30.7.1", "by": ["grype"], "ref": "https://github.com/patriksimek/vm2/releases/tag/v3.11.0"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.15.12", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "kafka-old", "ip": "172.30.47.1", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.8.11.2", "fix": "2.8.11.3", "target": "kafka-old", "ip": "172.30.47.1", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.15.12", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "kafka011", "ip": "172.31.1.60", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.8.11.2", "fix": "2.8.11.3", "target": "kafka011", "ip": "172.31.1.60", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "GHSA-4vmm-mhcq-4x9j", "cvss": 10.0, "title": "Sandbox Bypass Leading to Arbitrary Code Execution in constantinople", "cat": "pkg-vuln", "pkg": "constantinople", "ver": "3.0.2", "fix": "3.1.1", "target": "kibana-old", "ip": "172.30.19.1", "by": ["trivy"], "ref": "https://bugzilla.redhat.com/show_bug.cgi?id=1577703"}, {"sev": "critical", "id": "GHSA-4vmm-mhcq-4x9j", "cvss": 10.0, "title": "GHSA-4vmm-mhcq-4x9j", "cat": "pkg-vuln", "pkg": "constantinople", "ver": "3.0.2", "fix": "3.1.1", "target": "kibana-old", "ip": "172.30.19.1", "by": ["grype"], "ref": "https://bugzilla.redhat.com/show_bug.cgi?id=1577703"}, {"sev": "critical", "id": "GHSA-4vmm-mhcq-4x9j", "cvss": 10.0, "title": "GHSA-4vmm-mhcq-4x9j", "cat": "pkg-vuln", "pkg": "constantinople", "ver": "3.0.2", "fix": "3.1.1", "target": "kibana56", "ip": "172.31.1.68", "by": ["grype"], "ref": "https://bugzilla.redhat.com/show_bug.cgi?id=1577703"}, {"sev": "critical", "id": "CVE-2024-3094", "cvss": 10.0, "title": "xz: malicious code in distributed source", "cat": "pkg-vuln", "pkg": "lighttpd", "ver": "1.4.64-r0", "fix": "1.4.76-r0", "target": "lighttpd", "ip": "172.31.1.14", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/03/29/10"}, {"sev": "critical", "id": "CVE-2024-3094", "cvss": 10.0, "title": "xz: malicious code in distributed source", "cat": "pkg-vuln", "pkg": "lighttpd-mod_auth", "ver": "1.4.64-r0", "fix": "1.4.76-r0", "target": "lighttpd", "ip": "172.31.1.14", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/03/29/10"}, {"sev": "critical", "id": "CVE-2024-3094", "cvss": 10.0, "title": "CVE-2024-3094", "cat": "pkg-vuln", "pkg": "lighttpd", "ver": "1.4.64-r0", "fix": "1.4.76-r0", "target": "lighttpd", "ip": "172.31.1.14", "by": ["grype"], "ref": ""}, {"sev": "critical", "id": "CVE-2024-3094", "cvss": 10.0, "title": "CVE-2024-3094", "cat": "pkg-vuln", "pkg": "lighttpd-mod_auth", "ver": "1.4.64-r0", "fix": "1.4.76-r0", "target": "lighttpd", "ip": "172.31.1.14", "by": ["grype"], "ref": ""}, {"sev": "critical", "id": "CVE-2021-44228", "cvss": 10.0, "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "cat": "pkg-vuln", "pkg": "org.apache.logging.log4j:log4j-core", "ver": "2.14.1", "fix": "2.15.0, 2.3.1, 2.12.2", "target": "log4shell", "ip": "172.30.6.4", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.14.1", "fix": "2.15.0", "target": "log4shell", "ip": "172.30.6.4", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.9.5", "fix": "2.9.7", "target": "logstash56", "ip": "172.31.1.69", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.9.5", "fix": "2.9.7", "target": "logstash56", "ip": "172.31.1.69", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.9.5", "fix": "2.9.7", "target": "logstash56", "ip": "172.31.1.69", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.6.2", "fix": "2.12.2", "target": "logstash56", "ip": "172.31.1.69", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.6", "fix": "2.0.9.1", "target": "logstash56", "ip": "172.31.1.69", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.13", "fix": "2.0.9.1", "target": "mailcatcher", "ip": "172.30.17.1", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.19.67-2", "fix": "4.19.98-1", "target": "mediawiki-old", "ip": "172.30.32.1", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.19.67-2", "fix": "4.19.98-1", "target": "mediawiki-old", "ip": "172.30.32.1", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15504", "cvss": 10.0, "title": "kernel: double free in drivers/net/wireless/rsi/rsi_91x_usb.c via crafted USB device", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.19.67-2", "fix": "4.19.87-1", "target": "mediawiki-old", "ip": "172.30.32.1", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-15504"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.19.67-2", "fix": "4.19.87-1", "target": "mediawiki-old", "ip": "172.30.32.1", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-18017", "cvss": 10.0, "title": "kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.56-1", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u6", "fix": "7.38.0-4+deb8u12", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u6", "fix": "7.38.0-4+deb8u12", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.38.0-4+deb8u6", "fix": "7.38.0-4+deb8u12", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "mediawiki128", "ip": "172.31.1.94", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.4-2+b1", "fix": "2:1.9.4-2+deb9u1", "target": "metasploit-emulator", "ip": "172.30.40.6", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2015-8812", "cvss": 10.0, "title": "CVE-2015-8812", "cat": "pkg-vuln", "pkg": "linux-kernel", "ver": "2.6.24-16-server", "fix": "3.2.78, 3.10.99, 3.12.56, 3.14.63, 3.16.35, 3.18.31, 4.1.22, 4.4.4", "target": "metasploitable2", "ip": "172.30.1.1", "by": ["grype"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3"}, {"sev": "critical", "id": "CVE-2016-3955", "cvss": 10.0, "title": "CVE-2016-3955", "cat": "pkg-vuln", "pkg": "linux-kernel", "ver": "2.6.24-16-server", "fix": "3.2.80, 3.10.102, 3.12.59, 3.14.68, 3.18.37, 4.1.28, 4.4.9, 4.5.3", "target": "metasploitable2", "ip": "172.30.1.1", "by": ["grype"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb"}, {"sev": "critical", "id": "CVE-2017-7895", "cvss": 10.0, "title": "CVE-2017-7895", "cat": "pkg-vuln", "pkg": "linux-kernel", "ver": "2.6.24-16-server", "fix": "3.2.89, 3.16.44, 4.1.40, 4.4.67, 4.9.26, 4.10.14", "target": "metasploitable2", "ip": "172.30.1.1", "by": ["grype"], "ref": "http://www.debian.org/security/2017/dsa-3886"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "CVE-2019-15505", "cat": "pkg-vuln", "pkg": "linux-kernel", "ver": "2.6.24-16-server", "fix": "3.16.77, 4.4.194, 4.9.194, 4.14.146, 4.19.75, 5.2.17, 5.3.1", "target": "metasploitable2", "ip": "172.30.1.1", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2015-4599", "cvss": 10.0, "title": "CVE-2015-4599", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4"}, {"sev": "critical", "id": "CVE-2015-4599", "cvss": 10.0, "title": "CVE-2015-4599", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4"}, {"sev": "critical", "id": "CVE-2015-4600", "cvss": 10.0, "title": "CVE-2015-4600", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4600", "cvss": 10.0, "title": "CVE-2015-4600", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4601", "cvss": 10.0, "title": "CVE-2015-4601", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4601", "cvss": 10.0, "title": "CVE-2015-4601", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4602", "cvss": 10.0, "title": "CVE-2015-4602", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1"}, {"sev": "critical", "id": "CVE-2015-4602", "cvss": 10.0, "title": "CVE-2015-4602", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1"}, {"sev": "critical", "id": "CVE-2015-4603", "cvss": 10.0, "title": "CVE-2015-4603", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://php.net/ChangeLog-5.php"}, {"sev": "critical", "id": "CVE-2015-4603", "cvss": 10.0, "title": "CVE-2015-4603", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://php.net/ChangeLog-5.php"}, {"sev": "critical", "id": "CVE-2015-5589", "cvss": 10.0, "title": "CVE-2015-5589", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=bf58162ddf970f63502837f366930e44d6a992cf"}, {"sev": "critical", "id": "CVE-2015-5589", "cvss": 10.0, "title": "CVE-2015-5589", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=bf58162ddf970f63502837f366930e44d6a992cf"}, {"sev": "critical", "id": "CVE-2016-2554", "cvss": 10.0, "title": "CVE-2016-2554", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"}, {"sev": "critical", "id": "CVE-2016-2554", "cvss": 10.0, "title": "CVE-2016-2554", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"}, {"sev": "critical", "id": "GHSA-j77q-2qqg-6989", "cvss": 10.0, "title": "GHSA-j77q-2qqg-6989", "cat": "pkg-vuln", "pkg": "struts2-core", "ver": "2.3.16.3", "fix": "2.3.32", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "https://cwiki.apache.org/confluence/display/WW/S2-045"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.4", "fix": "2.0.9.1", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "2.0.4", "fix": "2.0.9.1", "target": "metasploitable3", "ip": "172.30.1.3", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "CVE-2015-4599", "cvss": 10.0, "title": "CVE-2015-4599", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4"}, {"sev": "critical", "id": "CVE-2015-4599", "cvss": 10.0, "title": "CVE-2015-4599", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4"}, {"sev": "critical", "id": "CVE-2015-4600", "cvss": 10.0, "title": "CVE-2015-4600", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4600", "cvss": 10.0, "title": "CVE-2015-4600", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4601", "cvss": 10.0, "title": "CVE-2015-4601", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4601", "cvss": 10.0, "title": "CVE-2015-4601", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8"}, {"sev": "critical", "id": "CVE-2015-4602", "cvss": 10.0, "title": "CVE-2015-4602", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1"}, {"sev": "critical", "id": "CVE-2015-4602", "cvss": 10.0, "title": "CVE-2015-4602", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1"}, {"sev": "critical", "id": "CVE-2015-4603", "cvss": 10.0, "title": "CVE-2015-4603", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://php.net/ChangeLog-5.php"}, {"sev": "critical", "id": "CVE-2015-4603", "cvss": 10.0, "title": "CVE-2015-4603", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://php.net/ChangeLog-5.php"}, {"sev": "critical", "id": "CVE-2015-5589", "cvss": 10.0, "title": "CVE-2015-5589", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=bf58162ddf970f63502837f366930e44d6a992cf"}, {"sev": "critical", "id": "CVE-2015-5589", "cvss": 10.0, "title": "CVE-2015-5589", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=bf58162ddf970f63502837f366930e44d6a992cf"}, {"sev": "critical", "id": "CVE-2016-2554", "cvss": 10.0, "title": "CVE-2016-2554", "cat": "pkg-vuln", "pkg": "libphp", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"}, {"sev": "critical", "id": "CVE-2016-2554", "cvss": 10.0, "title": "CVE-2016-2554", "cat": "pkg-vuln", "pkg": "php-cli", "ver": "5.4.5", "fix": "", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"}, {"sev": "critical", "id": "GHSA-j77q-2qqg-6989", "cvss": 10.0, "title": "GHSA-j77q-2qqg-6989", "cat": "pkg-vuln", "pkg": "struts2-core", "ver": "2.3.16.3", "fix": "2.3.32", "target": "metasploitable3-alt", "ip": "172.30.1.4", "by": ["grype"], "ref": "https://cwiki.apache.org/confluence/display/WW/S2-045"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.13.10", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "mongo36", "ip": "172.31.1.31", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.13.10", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "mysql56", "ip": "172.31.1.26", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u4", "fix": "", "target": "nginx-old", "ip": "172.30.15.1", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-7376", "cvss": 10.0, "title": "libxml2: Incorrect limit used for port values", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u4", "fix": "2.9.1+dfsg1-5+deb8u5", "target": "nginx-old", "ip": "172.30.15.1", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/98877"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "nginx-old", "ip": "172.30.15.1", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "node6", "ip": "172.31.1.39", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "node6", "ip": "172.31.1.39", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.168-1", "fix": "4.9.210-1", "target": "node6", "ip": "172.31.1.39", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.168-1", "fix": "4.9.210-1", "target": "node6", "ip": "172.31.1.39", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.168-1", "fix": "4.9.210-1", "target": "node6", "ip": "172.31.1.39", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "owncloud-old", "ip": "172.30.31.1", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "owncloud-old", "ip": "172.30.31.1", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "owncloud-old", "ip": "172.30.31.1", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "owncloud9", "ip": "172.31.1.92", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "owncloud9", "ip": "172.31.1.92", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "owncloud9", "ip": "172.31.1.92", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.13.10", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "pg95", "ip": "172.31.1.29", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "php56", "ip": "172.31.1.44", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "php56", "ip": "172.31.1.44", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "php56", "ip": "172.31.1.44", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "php70", "ip": "172.31.1.45", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "php70", "ip": "172.31.1.45", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "php70", "ip": "172.31.1.45", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.52.1-5", "fix": "7.52.1-5+deb9u7", "target": "phpldapadmin", "ip": "172.30.29.2", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "phpldapadmin-remote-dump", "ip": "172.30.40.5", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "phpldapadmin-remote-dump", "ip": "172.30.40.5", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl", "ver": "7.52.1-r2", "fix": "7.61.1-r0", "target": "phpmyadmin-old", "ip": "172.30.26.1", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.13.5", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "prometheus-old", "ip": "172.31.1.72", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.13.5", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "prometheus-old", "ip": "172.31.1.72", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.13.5", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "prometheus-old", "ip": "172.31.1.72", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.13.5", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "prometheus-old", "ip": "172.31.1.72", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2025-32433", "cvss": 10.0, "title": "CVE-2025-32433", "cat": "pkg-vuln", "pkg": "erlang", "ver": "22.3.4.7", "fix": "25.3.2.20, 26.2.5.11, 27.3.3", "target": "rabbit37", "ip": "172.31.1.59", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2025/04/16/2"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "2.2.3", "fix": "2.2.3.1", "target": "railsgoat", "ip": "172.30.8.3", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2-dev", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "3.1.2-2+deb8u4", "fix": "3.1.2-2+deb8u6", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "3.1.2-2+deb8u4", "fix": "3.1.2-2+deb8u6", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-18017", "cvss": 10.0, "title": "kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u3", "fix": "3.16.56-1", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u5", "fix": "7.38.0-4+deb8u12", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u5", "fix": "7.38.0-4+deb8u12", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.38.0-4+deb8u5", "fix": "7.38.0-4+deb8u12", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl4-openssl-dev", "ver": "7.38.0-4+deb8u5", "fix": "7.38.0-4+deb8u12", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u3", "fix": "3.16.81-1", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u3", "fix": "3.16.81-1", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u3", "fix": "3.16.81-1", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "railsgoat-alt", "ip": "172.30.8.5", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "v1.16.7", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "redis50", "ip": "172.31.1.33", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2026:4177"}, {"sev": "critical", "id": "CVE-2025-68121", "cvss": 10.0, "title": "CVE-2025-68121", "cat": "pkg-vuln", "pkg": "stdlib", "ver": "go1.16.7", "fix": "1.24.13, 1.25.7, 1.26.0-rc.3", "target": "redis50", "ip": "172.31.1.33", "by": ["grype", "osv"], "ref": "https://go.dev/cl/737700"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2019-11027", "cvss": 10.0, "title": "rubygem-ruby-openid: Unknown remotely exploitable flaw", "cat": "pkg-vuln", "pkg": "ruby-openid", "ver": "2.3.0", "fix": ">= 2.9.0", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-11027"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.144-3.1", "fix": "4.9.210-1", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.144-3.1", "fix": "4.9.210-1", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.144-3.1", "fix": "4.9.210-1", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2022-30123", "cvss": 10.0, "title": "rubygem-rack: crafted requests can cause shell escape sequences", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.11", "fix": "~> 2.0.9, >= 2.0.9.1, ~> 2.1.4, >= 2.1.4.1, >= 2.2.3.1", "target": "redmine33", "ip": "172.31.1.95", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2022-30123"}, {"sev": "critical", "id": "GHSA-wq4h-7r42-5hrr", "cvss": 10.0, "title": "GHSA-wq4h-7r42-5hrr", "cat": "pkg-vuln", "pkg": "rack", "ver": "1.6.11", "fix": "2.0.9.1", "target": "redmine33", "ip": "172.31.1.95", "by": ["grype"], "ref": "https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u5", "fix": "", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-18017", "cvss": 10.0, "title": "kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.56-1", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2638fd0f92d4397884fd991d8f4925cb3f081901"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u7", "fix": "7.38.0-4+deb8u12", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u7", "fix": "7.38.0-4+deb8u12", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "3.16.43-2+deb8u5", "fix": "3.16.81-1", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "sambacry", "ip": "172.30.4.1", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2014-6271", "cvss": 10.0, "title": "bash: specially-crafted environment variables can be used to inject shell commands", "cat": "pkg-vuln", "pkg": "bash", "ver": "4.2+dfsg-0.1", "fix": "4.2+dfsg-0.1+deb7u1", "target": "shellshock-lab", "ip": "172.30.40.7", "by": ["trivy"], "ref": "http://advisories.mageia.org/MGASA-2014-0388.html"}, {"sev": "critical", "id": "CVE-2014-7169", "cvss": 10.0, "title": "bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)", "cat": "pkg-vuln", "pkg": "bash", "ver": "4.2+dfsg-0.1", "fix": "4.2+dfsg-0.1+deb7u3", "target": "shellshock-lab", "ip": "172.30.40.7", "by": ["trivy"], "ref": "http://advisories.mageia.org/MGASA-2014-0393.html"}, {"sev": "critical", "id": "CVE-2025-66516", "cvss": 10.0, "title": "tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope ", "cat": "pkg-vuln", "pkg": "org.apache.tika:tika-core", "ver": "1.16", "fix": "3.2.2", "target": "solr-old", "ip": "172.30.45.1", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2025-66516"}, {"sev": "critical", "id": "CVE-2025-66516", "cvss": 10.0, "title": "tika-core: tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope ", "cat": "pkg-vuln", "pkg": "org.apache.tika:tika-parsers", "ver": "1.16", "fix": "2.0.0", "target": "solr-old", "ip": "172.30.45.1", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2025-66516"}, {"sev": "critical", "id": "GHSA-f58c-gq56-vjjf", "cvss": 10.0, "title": "GHSA-f58c-gq56-vjjf", "cat": "pkg-vuln", "pkg": "tika-core", "ver": "1.16", "fix": "3.2.2", "target": "solr-old", "ip": "172.30.45.1", "by": ["grype"], "ref": "https://cve.org/CVERecord?id=CVE-2025-54988"}, {"sev": "critical", "id": "GHSA-f58c-gq56-vjjf", "cvss": 10.0, "title": "GHSA-f58c-gq56-vjjf", "cat": "pkg-vuln", "pkg": "tika-parsers", "ver": "1.16", "fix": "2.0.0", "target": "solr-old", "ip": "172.30.45.1", "by": ["grype"], "ref": "https://cve.org/CVERecord?id=CVE-2025-54988"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u3", "fix": "7.52.1-5+deb9u7", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u3", "fix": "7.52.1-5+deb9u7", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.52.1-5+deb9u3", "fix": "7.52.1-5+deb9u7", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26.2-1.1+deb9u1", "fix": "2:3.26.2-1.1+deb9u2", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.4-2+b1", "fix": "2:1.9.4-2+deb9u1", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2021-42392", "cvss": 10.0, "title": "h2: Remote Code Execution in Console", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.176", "fix": "2.0.206", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2021-42392"}, {"sev": "critical", "id": "CVE-2021-44228", "cvss": 10.0, "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "cat": "pkg-vuln", "pkg": "org.apache.logging.log4j:log4j-core", "ver": "2.8.2", "fix": "2.15.0, 2.3.1, 2.12.2", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2021-44228", "cvss": 10.0, "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "cat": "pkg-vuln", "pkg": "org.apache.logging.log4j:log4j-core", "ver": "2.9.1", "fix": "2.15.0, 2.3.1, 2.12.2", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2022-23221", "cvss": 10.0, "title": "h2: Loading of custom classes from remote servers through JNDI", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.176", "fix": "2.1.210", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2024-1597", "cvss": 10.0, "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "cat": "pkg-vuln", "pkg": "org.postgresql:postgresql", "ver": "42.1.1", "fix": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "target": "sonar67", "ip": "172.31.1.52", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/04/02/6"}, {"sev": "critical", "id": "GHSA-24rp-q3w6-vc56", "cvss": 10.0, "title": "GHSA-24rp-q3w6-vc56", "cat": "pkg-vuln", "pkg": "postgresql", "ver": "42.1.1", "fix": "42.2.28", "target": "sonar67", "ip": "172.31.1.52", "by": ["grype"], "ref": "https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.8.2", "fix": "2.12.2", "target": "sonar67", "ip": "172.31.1.52", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.9.1", "fix": "2.12.2", "target": "sonar67", "ip": "172.31.1.52", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2017-17458", "cvss": 10.0, "title": "mercurial: arbitrary command execution in mercurial repo with a git submodule", "cat": "pkg-vuln", "pkg": "mercurial-common", "ver": "4.0-1+deb9u1", "fix": "4.0-1+deb9u2", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/102926"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u4", "fix": "7.52.1-5+deb9u7", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u4", "fix": "7.52.1-5+deb9u7", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3-gnutls", "ver": "7.52.1-5+deb9u4", "fix": "7.52.1-5+deb9u7", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26.2-1.1+deb9u1", "fix": "2:3.26.2-1.1+deb9u2", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.4-2+b1", "fix": "2:1.9.4-2+deb9u1", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2021-42392", "cvss": 10.0, "title": "h2: Remote Code Execution in Console", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.176", "fix": "2.0.206", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2021-42392"}, {"sev": "critical", "id": "CVE-2021-44228", "cvss": 10.0, "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "cat": "pkg-vuln", "pkg": "org.apache.logging.log4j:log4j-core", "ver": "2.8.2", "fix": "2.15.0, 2.3.1, 2.12.2", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2021-44228", "cvss": 10.0, "title": "log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value", "cat": "pkg-vuln", "pkg": "org.apache.logging.log4j:log4j-core", "ver": "2.9.1", "fix": "2.15.0, 2.3.1, 2.12.2", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2022-23221", "cvss": 10.0, "title": "h2: Loading of custom classes from remote servers through JNDI", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.176", "fix": "2.1.210", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2024-1597", "cvss": 10.0, "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "cat": "pkg-vuln", "pkg": "org.postgresql:postgresql", "ver": "42.2.1", "fix": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "target": "sonar70", "ip": "172.31.1.53", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/04/02/6"}, {"sev": "critical", "id": "GHSA-24rp-q3w6-vc56", "cvss": 10.0, "title": "GHSA-24rp-q3w6-vc56", "cat": "pkg-vuln", "pkg": "postgresql", "ver": "42.2.1", "fix": "42.2.28", "target": "sonar70", "ip": "172.31.1.53", "by": ["grype"], "ref": "https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.8.2", "fix": "2.12.2", "target": "sonar70", "ip": "172.31.1.53", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-jfh8-c2jp-5v3q", "cvss": 10.0, "title": "GHSA-jfh8-c2jp-5v3q", "cat": "pkg-vuln", "pkg": "log4j-core", "ver": "2.9.1", "fix": "2.12.2", "target": "sonar70", "ip": "172.31.1.53", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "ssrflab", "ip": "172.31.1.106", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "ssrflab", "ip": "172.31.1.106", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "ssrflab", "ip": "172.31.1.106", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u4", "fix": "", "target": "tomcat6", "ip": "172.31.1.16", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2017-7376", "cvss": 10.0, "title": "libxml2: Incorrect limit used for port values", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u4", "fix": "2.9.1+dfsg1-5+deb8u5", "target": "tomcat6", "ip": "172.31.1.16", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/98877"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u5", "fix": "7.38.0-4+deb8u12", "target": "tomcat6", "ip": "172.31.1.16", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u5", "fix": "7.38.0-4+deb8u12", "target": "tomcat6", "ip": "172.31.1.16", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26-1+debu8u2", "fix": "2:3.26-1+debu8u10", "target": "tomcat6", "ip": "172.31.1.16", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2020-10188", "cvss": 10.0, "title": "telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code", "cat": "pkg-vuln", "pkg": "inetutils-ping", "ver": "2:1.9.2.39.3a460-3", "fix": "2:1.9.2.39.3a460-3+deb8u1", "target": "tomcat6", "ip": "172.31.1.16", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2026/01/20/8"}, {"sev": "critical", "id": "CVE-2016-4448", "cvss": 10.0, "title": "libxml2: Format string vulnerability", "cat": "pkg-vuln", "pkg": "libxml2", "ver": "2.9.1+dfsg1-5+deb8u6", "fix": "", "target": "tomcat8", "ip": "172.31.1.18", "by": ["trivy"], "ref": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.38.0-4+deb8u11", "fix": "7.38.0-4+deb8u12", "target": "tomcat8", "ip": "172.31.1.18", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2018-14618", "cvss": 10.0, "title": "curl: NTLM password overflow via integer overflow", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.38.0-4+deb8u11", "fix": "7.38.0-4+deb8u12", "target": "tomcat8", "ip": "172.31.1.18", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041605"}, {"sev": "critical", "id": "CVE-2019-17006", "cvss": 10.0, "title": "nss: Check length of inputs for cryptographic primitives", "cat": "pkg-vuln", "pkg": "libnss3", "ver": "2:3.26-1+debu8u3", "fix": "2:3.26-1+debu8u10", "target": "tomcat8", "ip": "172.31.1.18", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-17006"}, {"sev": "critical", "id": "CVE-2026-35051", "cvss": 10.0, "title": "CVE-2026-35051", "cat": "pkg-vuln", "pkg": "traefik", "ver": "1.5.4", "fix": "2.11.43, 3.6.14, 3.7.0-rc.2", "target": "traefik15", "ip": "172.31.1.80", "by": ["grype"], "ref": "https://github.com/traefik/traefik/releases/tag/v2.11.43"}, {"sev": "critical", "id": "CVE-2026-39858", "cvss": 10.0, "title": "CVE-2026-39858", "cat": "pkg-vuln", "pkg": "traefik", "ver": "1.5.4", "fix": "2.11.43, 3.6.14, 3.7.0-rc.2", "target": "traefik15", "ip": "172.31.1.80", "by": ["grype"], "ref": "https://github.com/traefik/traefik/releases/tag/v2.11.43"}, {"sev": "critical", "id": "GHSA-9mxf-g3x6-wv74", "cvss": 10.0, "title": "GHSA-9mxf-g3x6-wv74", "cat": "pkg-vuln", "pkg": "jackson-databind", "ver": "2.7.4", "fix": "2.7.9.5", "target": "wildfly10", "ip": "172.31.1.22", "by": ["grype"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "CVE-2015-7501", "cvss": 10.0, "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation", "cat": "pkg-vuln", "pkg": "commons-collections:commons-collections", "ver": "3.2.1", "fix": "3.2.2", "target": "wildfly9", "ip": "172.31.1.21", "by": ["trivy"], "ref": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"}, {"sev": "critical", "id": "CVE-2021-42392", "cvss": 10.0, "title": "h2: Remote Code Execution in Console", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.173", "fix": "2.0.206", "target": "wildfly9", "ip": "172.31.1.21", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2021-42392"}, {"sev": "critical", "id": "CVE-2022-23221", "cvss": 10.0, "title": "h2: Loading of custom classes from remote servers through JNDI", "cat": "pkg-vuln", "pkg": "com.h2database:h2", "ver": "1.3.173", "fix": "2.1.210", "target": "wildfly9", "ip": "172.31.1.21", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2019-14896", "cvss": 10.0, "title": "kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "wp49", "ip": "172.31.1.83", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html"}, {"sev": "critical", "id": "CVE-2019-14901", "cvss": 10.0, "title": "kernel: heap overflow in marvell/mwifiex/tdls.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "wp49", "ip": "172.31.1.83", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html"}, {"sev": "critical", "id": "CVE-2019-15505", "cvss": 10.0, "title": "kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c", "cat": "pkg-vuln", "pkg": "linux-libc-dev", "ver": "4.9.130-2", "fix": "4.9.210-1", "target": "wp49", "ip": "172.31.1.83", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"}, {"sev": "critical", "id": "CVE-2024-52046", "cvss": 10.0, "title": "mina-core: Apache MINA: applications using unbounded deserialization may allow RCE", "cat": "pkg-vuln", "pkg": "org.apache.mina:mina-core", "ver": "2.0.7", "fix": "2.2.4, 2.1.10, 2.0.27", "target": "zookeeper-old", "ip": "172.30.46.1", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2024/12/25/1"}, {"sev": "critical", "id": "GHSA-76h9-2vwh-w278", "cvss": 10.0, "title": "GHSA-76h9-2vwh-w278", "cat": "pkg-vuln", "pkg": "mina-core", "ver": "2.0.7", "fix": "2.0.27", "target": "zookeeper-old", "ip": "172.30.46.1", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2024/12/25/1"}, {"sev": "critical", "id": "GHSA-vqfx-gj96-3w95", "cvss": 9.9, "title": "GHSA-vqfx-gj96-3w95", "cat": "pkg-vuln", "pkg": "sequelize", "ver": "4.23.1", "fix": "6.28.1", "target": "dvna", "ip": "172.31.1.104", "by": ["grype"], "ref": "https://csirt.divd.nl/CVE-2023-22579"}, {"sev": "critical", "id": "GHSA-72gx-qq2m-6xr2", "cvss": 9.9, "title": "GHSA-72gx-qq2m-6xr2", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.18.1", "fix": "1.65", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2019/10/01/2"}, {"sev": "critical", "id": "GHSA-ccr8-4xr7-cgj3", "cvss": 9.9, "title": "GHSA-ccr8-4xr7-cgj3", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.18.1", "fix": "1.66.5", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2020/09/23/1"}, {"sev": "critical", "id": "GHSA-f6mq-6fx5-w2ch", "cvss": 9.9, "title": "GHSA-f6mq-6fx5-w2ch", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.18.1", "fix": "1184.v85d16b_d851b_3", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2022/10/19/3"}, {"sev": "critical", "id": "GHSA-qxf8-8837-hq7w", "cvss": 9.9, "title": "GHSA-qxf8-8837-hq7w", "cat": "pkg-vuln", "pkg": "matrix-project", "ver": "1.4.1", "fix": "1.14", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["grype"], "ref": "http://www.securityfocus.com/bid/107476"}, {"sev": "critical", "id": "GHSA-xvxq-hq48-xphm", "cvss": 9.9, "title": "GHSA-xvxq-hq48-xphm", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.18.1", "fix": "1.54", "target": "jenkins2150", "ip": "172.31.1.49", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"}, {"sev": "critical", "id": "GHSA-72gx-qq2m-6xr2", "cvss": 9.9, "title": "GHSA-72gx-qq2m-6xr2", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.13", "fix": "1.65", "target": "jenkins260", "ip": "172.31.1.48", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2019/10/01/2"}, {"sev": "critical", "id": "GHSA-ccr8-4xr7-cgj3", "cvss": 9.9, "title": "GHSA-ccr8-4xr7-cgj3", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.13", "fix": "1.66.5", "target": "jenkins260", "ip": "172.31.1.48", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2020/09/23/1"}, {"sev": "critical", "id": "GHSA-f6mq-6fx5-w2ch", "cvss": 9.9, "title": "GHSA-f6mq-6fx5-w2ch", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.13", "fix": "1184.v85d16b_d851b_3", "target": "jenkins260", "ip": "172.31.1.48", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2022/10/19/3"}, {"sev": "critical", "id": "GHSA-qxf8-8837-hq7w", "cvss": 9.9, "title": "GHSA-qxf8-8837-hq7w", "cat": "pkg-vuln", "pkg": "matrix-project", "ver": "1.4.1", "fix": "1.14", "target": "jenkins260", "ip": "172.31.1.48", "by": ["grype"], "ref": "http://www.securityfocus.com/bid/107476"}, {"sev": "critical", "id": "GHSA-xvxq-hq48-xphm", "cvss": 9.9, "title": "GHSA-xvxq-hq48-xphm", "cat": "pkg-vuln", "pkg": "script-security", "ver": "1.13", "fix": "1.54", "target": "jenkins260", "ip": "172.31.1.48", "by": ["grype"], "ref": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2024-41110", "cvss": 9.9, "title": "CVE-2024-41110", "cat": "pkg-vuln", "pkg": "docker", "ver": "20.10.3-r1", "fix": "", "target": "kafka-old", "ip": "172.30.47.1", "by": ["grype"], "ref": "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"}, {"sev": "critical", "id": "CVE-2024-41110", "cvss": 9.9, "title": "CVE-2024-41110", "cat": "pkg-vuln", "pkg": "docker-cli", "ver": "20.10.3-r1", "fix": "", "target": "kafka-old", "ip": "172.30.47.1", "by": ["grype"], "ref": "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"}, {"sev": "critical", "id": "CVE-2024-41110", "cvss": 9.9, "title": "CVE-2024-41110", "cat": "pkg-vuln", "pkg": "docker-engine", "ver": "20.10.3-r1", "fix": "", "target": "kafka-old", "ip": "172.30.47.1", "by": ["grype"], "ref": "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"}, {"sev": "critical", "id": "CVE-2024-41110", "cvss": 9.9, "title": "CVE-2024-41110", "cat": "pkg-vuln", "pkg": "docker", "ver": "20.10.3-r1", "fix": "", "target": "kafka011", "ip": "172.31.1.60", "by": ["grype"], "ref": "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"}, {"sev": "critical", "id": "CVE-2024-41110", "cvss": 9.9, "title": "CVE-2024-41110", "cat": "pkg-vuln", "pkg": "docker-cli", "ver": "20.10.3-r1", "fix": "", "target": "kafka011", "ip": "172.31.1.60", "by": ["grype"], "ref": "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"}, {"sev": "critical", "id": "CVE-2024-41110", "cvss": 9.9, "title": "CVE-2024-41110", "cat": "pkg-vuln", "pkg": "docker-engine", "ver": "20.10.3-r1", "fix": "", "target": "kafka011", "ip": "172.31.1.60", "by": ["grype"], "ref": "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191"}, {"sev": "critical", "id": "CVE-2025-49844", "cvss": 9.9, "title": "CVE-2025-49844", "cat": "pkg-vuln", "pkg": "redis", "ver": "4.0.14", "fix": "6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2", "target": "redis-noauth", "ip": "172.30.14.4", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2025/10/07/2"}, {"sev": "critical", "id": "CVE-2025-49844", "cvss": 9.9, "title": "CVE-2025-49844", "cat": "pkg-vuln", "pkg": "redis", "ver": "3.2.12", "fix": "6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2", "target": "redis32", "ip": "172.31.1.32", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2025/10/07/2"}, {"sev": "critical", "id": "CVE-2025-49844", "cvss": 9.9, "title": "CVE-2025-49844", "cat": "pkg-vuln", "pkg": "redis", "ver": "5.0.14", "fix": "6.2.20, 7.2.11, 7.4.6, 8.0.4, 8.2.2", "target": "redis50", "ip": "172.31.1.33", "by": ["grype"], "ref": "http://www.openwall.com/lists/oss-security/2025/10/07/2"}, {"sev": "critical", "id": "CVE-2016-1000027", "cvss": 9.8, "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "cat": "pkg-vuln", "pkg": "org.springframework:spring-web", "ver": "4.1.9.RELEASE", "fix": "6.0.0", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2016-1000027"}, {"sev": "critical", "id": "CVE-2016-4437", "cvss": 9.8, "title": "shiro: Security constraint bypass", "cat": "pkg-vuln", "pkg": "org.apache.shiro:shiro-core", "ver": "1.2.4", "fix": "1.2.5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html"}, {"sev": "critical", "id": "CVE-2017-12424", "cvss": 9.8, "title": "shadow-utils: Buffer overflow via newusers tool", "cat": "pkg-vuln", "pkg": "login", "ver": "1:4.4-4.1", "fix": "1:4.4-4.1+deb9u1", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2017-12424"}, {"sev": "critical", "id": "CVE-2017-12424", "cvss": 9.8, "title": "shadow-utils: Buffer overflow via newusers tool", "cat": "pkg-vuln", "pkg": "passwd", "ver": "1:4.4-4.1", "fix": "1:4.4-4.1+deb9u1", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2017-12424"}, {"sev": "critical", "id": "CVE-2017-12652", "cvss": 9.8, "title": "libpng: does not check length of chunks against user limit", "cat": "pkg-vuln", "pkg": "libpng16-16", "ver": "1.6.28-1+deb9u1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/109269"}, {"sev": "critical", "id": "CVE-2017-14062", "cvss": 9.8, "title": "libidn2: Integer overflow in puny_decode.c/decode_digit", "cat": "pkg-vuln", "pkg": "libidn11", "ver": "1.33-1", "fix": "1.33-1+deb9u1", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.debian.org/security/2017/dsa-3988"}, {"sev": "critical", "id": "CVE-2017-15095", "cvss": 9.8, "title": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.8.11, 2.9.4, 2.6.7.3, 2.7.9.2", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"sev": "critical", "id": "CVE-2017-17485", "cvss": 9.8, "title": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.4, 2.8.11, 2.7.9.2", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.securityfocus.com/archive/1/541652/100/0/threaded"}, {"sev": "critical", "id": "CVE-2017-7525", "cvss": 9.8, "title": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.6.7.1, 2.7.9.1, 2.8.9", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"sev": "critical", "id": "CVE-2017-7657", "cvss": 9.8, "title": "jetty: HTTP request smuggling", "cat": "pkg-vuln", "pkg": "org.eclipse.jetty:jetty-server", "ver": "9.2.13.v20150730", "fix": "9.2.25.v20180606, 9.3.24.v20180605", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.securitytracker.com/id/1041194"}, {"sev": "critical", "id": "CVE-2017-7658", "cvss": 9.8, "title": "jetty: Incorrect header handling", "cat": "pkg-vuln", "pkg": "org.eclipse.jetty:jetty-server", "ver": "9.2.13.v20150730", "fix": "9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/106566"}, {"sev": "critical", "id": "CVE-2018-11307", "cvss": 9.8, "title": "jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.7.9.4, 2.8.11.2, 2.9.6", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2019:0782"}, {"sev": "critical", "id": "CVE-2018-14718", "cvss": 9.8, "title": "jackson-databind: arbitrary code execution in slf4j-ext class", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.7, 2.8.11.3, 2.7.9.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/106601"}, {"sev": "critical", "id": "CVE-2018-14719", "cvss": 9.8, "title": "jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.7, 2.8.11.3, 2.7.9.5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHBA-2019:0959"}, {"sev": "critical", "id": "CVE-2018-16402", "cvss": 9.8, "title": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash", "cat": "pkg-vuln", "pkg": "libelf1", "ver": "0.168-1", "fix": "0.168-1+deb9u1", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html"}, {"sev": "critical", "id": "CVE-2018-19362", "cvss": 9.8, "title": "jackson-databind: improper polymorphic deserialization in jboss-common-core class", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.8, 2.8.11.3, 2.7.9.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.securityfocus.com/bid/107985"}, {"sev": "critical", "id": "CVE-2018-7489", "cvss": 9.8, "title": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.8.11.1, 2.9.5, 2.7.9.3, 2.6.7.5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"}, {"sev": "critical", "id": "CVE-2019-12900", "cvss": 9.8, "title": "bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail).", "cat": "pkg-vuln", "pkg": "bzip2", "ver": "1.0.6-8.1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html"}, {"sev": "critical", "id": "CVE-2019-12900", "cvss": 9.8, "title": "bzip2: bzip2: Data integrity error when decompressing (with data integrity tests fail).", "cat": "pkg-vuln", "pkg": "libbz2-1.0", "ver": "1.0.6-8.1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html"}, {"sev": "critical", "id": "CVE-2019-14379", "cvss": 9.8, "title": "jackson-databind: default typing mishandling leading to remote code execution", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.9.2, 2.8.11.4, 2.7.9.6", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://seclists.org/fulldisclosure/2022/Mar/23"}, {"sev": "critical", "id": "CVE-2019-14540", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10, 2.8.11.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2019:3200"}, {"sev": "critical", "id": "CVE-2019-16335", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10, 2.8.11.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2019:3200"}, {"sev": "critical", "id": "CVE-2019-16942", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10.1, 2.8.11.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2019:3901"}, {"sev": "critical", "id": "CVE-2019-16943", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10.1, 2.8.11.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2020:0159"}, {"sev": "critical", "id": "CVE-2019-17267", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in classes of the ehcache package", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10, 2.8.11.5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2019:3200"}, {"sev": "critical", "id": "CVE-2019-17531", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10.1, 2.8.11.5, 2.6.7.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2019:4192"}, {"sev": "critical", "id": "CVE-2019-17571", "cvss": 9.8, "title": "log4j: deserialization of untrusted data in SocketServer", "cat": "pkg-vuln", "pkg": "log4j:log4j", "ver": "1.2.17", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"}, {"sev": "critical", "id": "CVE-2019-17571", "cvss": 9.8, "title": "log4j: deserialization of untrusted data in SocketServer", "cat": "pkg-vuln", "pkg": "log4j:log4j", "ver": "1.2.17", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html"}, {"sev": "critical", "id": "CVE-2019-20330", "cvss": 9.8, "title": "jackson-databind: lacks certain net.sf.ehcache blocking", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.2", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2019-20330"}, {"sev": "critical", "id": "CVE-2019-5481", "cvss": 9.8, "title": "curl: double free due to subsequent call of realloc()", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u9", "fix": "7.52.1-5+deb9u10", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html"}, {"sev": "critical", "id": "CVE-2019-5481", "cvss": 9.8, "title": "curl: double free due to subsequent call of realloc()", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u9", "fix": "7.52.1-5+deb9u10", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html"}, {"sev": "critical", "id": "CVE-2019-5482", "cvss": 9.8, "title": "curl: heap buffer overflow in function tftp_receive_packet()", "cat": "pkg-vuln", "pkg": "curl", "ver": "7.52.1-5+deb9u9", "fix": "7.52.1-5+deb9u10", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html"}, {"sev": "critical", "id": "CVE-2019-5482", "cvss": 9.8, "title": "curl: heap buffer overflow in function tftp_receive_packet()", "cat": "pkg-vuln", "pkg": "libcurl3", "ver": "7.52.1-5+deb9u9", "fix": "7.52.1-5+deb9u10", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html"}, {"sev": "critical", "id": "CVE-2019-8457", "cvss": 9.8, "title": "sqlite: heap out-of-bound read in function rtreenode()", "cat": "pkg-vuln", "pkg": "libdb5.3", "ver": "5.3.28-12+deb9u1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html"}, {"sev": "critical", "id": "CVE-2019-8457", "cvss": 9.8, "title": "sqlite: heap out-of-bound read in function rtreenode()", "cat": "pkg-vuln", "pkg": "libsqlite3-0", "ver": "3.16.2-5+deb9u1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html"}, {"sev": "critical", "id": "CVE-2020-11989", "cvss": 9.8, "title": "shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass", "cat": "pkg-vuln", "pkg": "org.apache.shiro:shiro-core", "ver": "1.2.4", "fix": "1.5.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2020-11989"}, {"sev": "critical", "id": "CVE-2020-17510", "cvss": 9.8, "title": "shiro: specially crafted HTTP request may cause an authentication bypass", "cat": "pkg-vuln", "pkg": "org.apache.shiro:shiro-spring", "ver": "1.2.4", "fix": "1.7.0", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2020-17510"}, {"sev": "critical", "id": "CVE-2020-17523", "cvss": 9.8, "title": "shiro: Authentication bypass through specially crafted HTTP request", "cat": "pkg-vuln", "pkg": "org.apache.shiro:shiro-spring", "ver": "1.2.4", "fix": "1.7.1", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://shiro.apache.org/download.html"}, {"sev": "critical", "id": "CVE-2020-1957", "cvss": 9.8, "title": "shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass", "cat": "pkg-vuln", "pkg": "org.apache.shiro:shiro-core", "ver": "1.2.4", "fix": "1.5.2", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2020-1957"}, {"sev": "critical", "id": "CVE-2020-8840", "cvss": 9.8, "title": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.3", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en"}, {"sev": "critical", "id": "CVE-2020-9547", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in ibatis-sqlmap", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10.4, 2.8.11.6, 2.7.9.7", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2020-9547"}, {"sev": "critical", "id": "CVE-2020-9548", "cvss": 9.8, "title": "jackson-databind: Serialization gadgets in anteros-core", "cat": "pkg-vuln", "pkg": "com.fasterxml.jackson.core:jackson-databind", "ver": "2.6.3", "fix": "2.9.10.4, 2.8.11.6, 2.7.9.7", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2020-9548"}, {"sev": "critical", "id": "CVE-2021-3520", "cvss": 9.8, "title": "lz4: memory corruption due to an integer overflow bug caused by memmove argument", "cat": "pkg-vuln", "pkg": "liblz4-1", "ver": "0.0~r131-2+b1", "fix": "0.0~r131-2+deb9u1", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2021-3520"}, {"sev": "critical", "id": "CVE-2021-41303", "cvss": 9.8, "title": "shiro: specially crafted HTTP request may cause an authentication bypass", "cat": "pkg-vuln", "pkg": "org.apache.shiro:shiro-core", "ver": "1.2.4", "fix": "1.8.0", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2021-41303"}, {"sev": "critical", "id": "CVE-2022-1664", "cvss": 9.8, "title": "Dpkg::Source::Archive in dpkg, the Debian package management system, b ...", "cat": "pkg-vuln", "pkg": "dpkg", "ver": "1.18.25", "fix": "1.18.26", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495"}, {"sev": "critical", "id": "CVE-2022-2274", "cvss": 9.8, "title": "CVE-2022-2274", "cat": "pkg-vuln", "pkg": "libssl1.1", "ver": "1.1.0j-1~deb9u1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["grype"], "ref": ""}, {"sev": "critical", "id": "CVE-2022-2274", "cvss": 9.8, "title": "CVE-2022-2274", "cat": "pkg-vuln", "pkg": "openssl", "ver": "1.1.0j-1~deb9u1", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["grype"], "ref": ""}, {"sev": "critical", "id": "CVE-2022-22822", "cvss": 9.8, "title": "expat: Integer overflow in addBinding in xmlparse.c", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u4", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/01/17/3"}, {"sev": "critical", "id": "CVE-2022-22823", "cvss": 9.8, "title": "expat: Integer overflow in build_model in xmlparse.c", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u4", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/01/17/3"}, {"sev": "critical", "id": "CVE-2022-22824", "cvss": 9.8, "title": "expat: Integer overflow in defineAttribute in xmlparse.c", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u4", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/01/17/3"}, {"sev": "critical", "id": "CVE-2022-22965", "cvss": 9.8, "title": "spring-framework: RCE via Data Binding on JDK 9+", "cat": "pkg-vuln", "pkg": "org.springframework:spring-beans", "ver": "4.1.9.RELEASE", "fix": "5.2.20.RELEASE, 5.3.18", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2022-22965", "cvss": 9.8, "title": "spring-framework: RCE via Data Binding on JDK 9+", "cat": "pkg-vuln", "pkg": "org.springframework:spring-webmvc", "ver": "4.1.9.RELEASE", "fix": "5.2.20.RELEASE, 5.3.18", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2022-23305", "cvss": 9.8, "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "cat": "pkg-vuln", "pkg": "log4j:log4j", "ver": "1.2.17", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/01/18/4"}, {"sev": "critical", "id": "CVE-2022-23305", "cvss": 9.8, "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "cat": "pkg-vuln", "pkg": "log4j:log4j", "ver": "1.2.17", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/01/18/4"}, {"sev": "critical", "id": "CVE-2022-23307", "cvss": 9.8, "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "cat": "pkg-vuln", "pkg": "log4j:log4j", "ver": "1.2.17", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2022-23307"}, {"sev": "critical", "id": "CVE-2022-23307", "cvss": 9.8, "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "cat": "pkg-vuln", "pkg": "log4j:log4j", "ver": "1.2.17", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2022-23307"}, {"sev": "critical", "id": "CVE-2022-23852", "cvss": 9.8, "title": "expat: Integer overflow in function XML_GetBuffer", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2022:0951"}, {"sev": "critical", "id": "CVE-2022-25235", "cvss": 9.8, "title": "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/02/19/1"}, {"sev": "critical", "id": "CVE-2022-25236", "cvss": 9.8, "title": "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html"}, {"sev": "critical", "id": "CVE-2022-25315", "cvss": 9.8, "title": "expat: Integer overflow in storeRawNames()", "cat": "pkg-vuln", "pkg": "libexpat1", "ver": "2.2.0-2+deb9u1", "fix": "2.2.0-2+deb9u5", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "http://www.openwall.com/lists/oss-security/2022/02/19/1"}, {"sev": "critical", "id": "CVE-2022-27404", "cvss": 9.8, "title": "FreeType: Buffer overflow in sfnt_init_face", "cat": "pkg-vuln", "pkg": "libfreetype6", "ver": "2.6.3-3.2", "fix": "", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/errata/RHSA-2022:8340"}, {"sev": "critical", "id": "CVE-2022-29155", "cvss": 9.8, "title": "openldap: OpenLDAP SQL injection", "cat": "pkg-vuln", "pkg": "libldap-2.4-2", "ver": "2.4.44+dfsg-5+deb9u2", "fix": "2.4.44+dfsg-5+deb9u9", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2022-29155"}, {"sev": "critical", "id": "CVE-2022-29155", "cvss": 9.8, "title": "openldap: OpenLDAP SQL injection", "cat": "pkg-vuln", "pkg": "libldap-common", "ver": "2.4.44+dfsg-5+deb9u2", "fix": "2.4.44+dfsg-5+deb9u9", "target": "activemq-old", "ip": "172.30.20.2", "by": ["trivy"], "ref": "https://access.redhat.com/security/cve/CVE-2022-29155"}], "sxc": {"critical": {"pkg-vuln": 15807, "secret": 4}, "high": {"pkg-vuln": 65508, "image-config": 146, "secret": 77}, "medium": {"pkg-vuln": 187731, "secret": 3129, "image-config": 146}, "low": {"pkg-vuln": 62084, "image-config": 533}, "info": {"pkg-vuln": 40304, "sbom-component": 43553}, "unknown": {"pkg-vuln": 56915}}, "cats": ["pkg-vuln", "sbom-component", "secret", "image-config"], "most_exposed": ["node6", "python27", "artifactory5", "phpldapadmin", "python35", "dvna", "mediawiki-old", "redmine33", "railsgoat-alt", "sonar67", "express-old", "sonar70", "python36", "ruby23", "node8", "joomla38", "owncloud-old", "owncloud9", "dvwa", "railsgoat", "wp49", "go19", "jenkins2150", "ruby24", "ssrflab"]}</script>
<script>
const D = JSON.parse(document.getElementById('data').textContent);
const SEV = ['critical','high','medium','low','info','unknown'];
const SEVC = {critical:'#991b1b',high:'#dc2626',medium:'#d97706',low:'#16a34a',info:'#64748b',unknown:'#94a3b8'};
const esc = s => String(s==null?'':s).replace(/[&<>"]/g, c=>({'&':'&','<':'<','>':'>','"':'"'}[c]));
const nf = n => (typeof n==='number' ? n.toLocaleString('pt-BR') : esc(n));
const chip = s => `<span class="chip" style="background:${SEVC[s]||'#94a3b8'}">${esc(s)}</span>`;
function sevbar(o,w){ w=w||110; const t = SEV.reduce((a,s)=>a+(o[s]||0),0)||1;
const seg = SEV.filter(s=>o[s]).map(s=>`<span title="${s}: ${o[s]}" style="background:${SEVC[s]};width:${(o[s]/t*100).toFixed(2)}%"></span>`).join('') || '<span style="background:#e2e8f0;width:100%"></span>';
return `<span class="sevbar" style="width:${w}px">${seg}</span>`; }
// severity x category heatmap
(function(){ const tb = document.querySelector('#t-sxc tbody'); const colT = {}; let gT=0; let mx=1;
SEV.forEach(sv=>{ const row=D.sxc[sv]||{}; D.cats.forEach(c=>{ if((row[c]||0)>mx) mx=row[c]; }); });
SEV.forEach(sv=>{ const row=D.sxc[sv]||{}; let tot=0;
const tds = D.cats.map(c=>{ const v=row[c]||0; tot+=v; colT[c]=(colT[c]||0)+v; const a=v?Math.sqrt(v/mx):0;
return `<td style="background:rgba(153,27,27,${(a*0.55).toFixed(3)})">${v?nf(v):'·'}</td>`; }).join('');
gT+=tot; tb.insertAdjacentHTML('beforeend', `<tr><td>${chip(sv)}</td>${tds}<td class="b">${nf(tot)}</td></tr>`); });
tb.insertAdjacentHTML('beforeend', `<tr style="font-weight:600;background:#fbfcfd"><td>total</td>${D.cats.map(c=>`<td>${nf(colT[c]||0)}</td>`).join('')}<td>${nf(gT)}</td></tr>`);
})();
// most exposed
(function(){ const set=new Set(D.most_exposed);
const rows=D.targets.filter(r=>set.has(r.name)).sort((a,b)=>(b.crit*4+b.high)-(a.crit*4+a.high));
document.querySelector('#t-exp tbody').innerHTML = rows.map(r=>`<tr><td class="mono b">${esc(r.name)}</td><td class="mono">${esc(r.image)}</td><td class="mono">${esc(r.ip)}</td><td class="muted">${esc(r.category)}</td><td class="num">${nf(r.n)}</td><td class="num">${nf(r.crit)}</td><td class="num">${nf(r.high)}</td><td>${sevbar(r,140)}</td></tr>`).join('');
})();
// generic sortable + filterable table
function mkTable(sel, rows, cols, filterIn, countEl){
const tb = document.querySelector(sel+' tbody'); const ths = document.querySelectorAll(sel+' thead th');
let sortI=-1, asc=false, q='';
function txtOf(r){ return cols.map(c=>String(c.t?c.t(r):(r[c.k]??''))).join(' ').toLowerCase(); }
function view(){ let rs=rows;
if(q){ const qq=q.toLowerCase(); rs=rs.filter(r=>txtOf(r).includes(qq)); }
if(sortI>=0){ const c=cols[sortI]; rs=rs.slice().sort((a,b)=>{ let x=c.s?c.s(a):a[c.k], y=c.s?c.s(b):b[c.k];
if(x==null) x=c.num?-Infinity:''; if(y==null) y=c.num?-Infinity:'';
return c.num ? (asc?x-y:y-x) : (asc?String(x).localeCompare(String(y)):String(y).localeCompare(String(x))); }); }
tb.innerHTML = rs.map(r=>'<tr>'+cols.map(c=>`<td class="${c.cls||''}">${c.r(r)}</td>`).join('')+'</tr>').join('');
if(countEl) countEl.textContent = rs.length===rows.length ? '' : (rs.length+' / '+rows.length); }
ths.forEach((th,i)=>{ if(th.classList.contains('no-sort'))return; th.addEventListener('click',()=>{ if(sortI===i)asc=!asc; else{sortI=i;asc=false;} view(); }); });
if(filterIn) filterIn.addEventListener('input', e=>{ q=e.target.value; view(); });
view();
}
mkTable('#t-cont', D.targets, [
{k:'name',cls:'mono b',r:r=>esc(r.name)}, {k:'image',cls:'mono',r:r=>esc(r.image)}, {k:'ip',cls:'mono',r:r=>esc(r.ip)},
{k:'category',cls:'muted',r:r=>esc(r.category)}, {k:'n',num:true,cls:'num',r:r=>nf(r.n)},
{k:'crit',num:true,cls:'num',r:r=>nf(r.crit)}, {k:'high',num:true,cls:'num',r:r=>nf(r.high)},
{k:'med',num:true,cls:'num',r:r=>nf(r.med)}, {k:'low',num:true,cls:'num',r:r=>nf(r.low)}, {k:'info',num:true,cls:'num',r:r=>nf(r.info)},
{k:'_b',cls:'',num:true,s:r=>r.crit*4+r.high,r:r=>sevbar(r,120),t:r=>''}, {k:'note',cls:'muted',r:r=>esc(r.note)},
], document.getElementById('q-cont'), document.getElementById('q-cont-n'));
mkTable('#t-find', D.findings, [
{k:'sev',num:true,cls:'',s:r=>SEV.indexOf(r.sev)*1000-(r.cvss||0),r:r=>chip(r.sev),t:r=>r.sev},
{k:'cvss',num:true,cls:'num',r:r=>r.cvss!=null?r.cvss:'·'},
{k:'id',cls:'mono b',r:r=>r.ref?`<a href="${esc(r.ref)}" target="_blank" rel="noopener">${esc(r.id)}</a>`:esc(r.id)},
{k:'title',cls:'',r:r=>esc(r.title)}, {k:'cat',cls:'muted',r:r=>esc(r.cat)},
{k:'pkg',cls:'mono',r:r=>esc(r.pkg)},
{k:'_vf',cls:'mono muted',s:r=>r.ver,r:r=>esc(r.ver)+(r.fix?' → '+esc(r.fix):''),t:r=>r.ver+' '+r.fix},
{k:'target',cls:'mono',r:r=>esc(r.target)}, {k:'ip',cls:'mono',r:r=>esc(r.ip)},
{k:'by',cls:'mono muted',s:r=>(r.by||[]).join(','),r:r=>esc((r.by||[]).join(', ')),t:r=>(r.by||[]).join(' ')},
], document.getElementById('q-find'), document.getElementById('q-find-n'));
// make the server-rendered scanner-coverage table sortable
(function(){ const t=document.getElementById('t-scan'); if(!t)return; const tb=t.tBodies[0]; const ths=t.tHead.rows[0].cells;
Array.from(ths).forEach((th,i)=>{ if(th.classList.contains('no-sort'))return; let asc=false;
th.addEventListener('click',()=>{ asc=!asc; const rs=Array.from(tb.rows).sort((a,b)=>{
const x=parseFloat(a.cells[i].textContent.replace(/[^\d.\-]/g,''))||0, y=parseFloat(b.cells[i].textContent.replace(/[^\d.\-]/g,''))||0; return asc?x-y:y-x; }); rs.forEach(r=>tb.appendChild(r)); }); });
})();
</script>
</body></html>