Software Collections

Vendor:

First CVE: Feb 15, 2016 · Active for 10 years

137
Total CVEs
More Total CVEs than 99% of tracked products
19.6
Avg CVEs / Year
Higher CVE frequency than 98% of tracked products
6.1
Avg CVSS
Higher Avg CVSS than 24% of tracked products
3.6%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Software Collections over time

Volume of CVEsAvg CVSS Base Score
First CVE
Feb 15, 2016
10 years ago
Most Recent CVE
Dec 10, 2023
960 days ago

CVE Severity & Scoring

Software Collections137 CVEs
All CVEs352,785 CVEs
LowMediumHighCritical
Attack Vector
Local7 (5.1%)
Network128 (93.4%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network2 (1.5%)
Attack Complexity
Low122 (89.1%)
High15 (10.9%)
Unknown0 (0.0%)
User Interaction
None133 (97.1%)
Unknown0 (0.0%)
Required4 (2.9%)
Privileges Required
Low31 (22.6%)
High63 (46.0%)
None43 (31.4%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (137 CVEs).

137 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2019-5418HIGH
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrar
Mar 27, 20197.599YESYES
CVE-2019-11043CRITICAL
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buff
Oct 28, 20199.898YESYES
CVE-2021-40438CRITICAL
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Sep 16, 20219.097YESYES
CVE-2016-0752HIGH
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote
Feb 16, 20167.597YESYES
CVE-2019-0211HIGH
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by
Apr 8, 20197.893YESYES
CVE-2021-4104HIGH
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName
Dec 14, 20217.570NONO
CVE-2016-0742HIGH
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted
Feb 15, 20167.570NONO
CVE-2020-9490HIGH
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to
Aug 7, 20207.568NONO
CVE-2019-9515HIGH
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RF
Aug 13, 20197.566NONO
CVE-2019-9514HIGH
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over ea
Aug 13, 20197.565NONO
View all 137 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (137 CVEs).

CISA KEV
5 CVEs
3.6% of CVEs· 97th percentile
Metasploit
3 CVEs
2.2% of CVEs· 96th percentile
Nuclei
2 CVEs
1.5% of CVEs· 96th percentile
ExploitDB
6 CVEs
4.4% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (137 CVEs).

Media Mentions

Signals from CVEs in this product scope (137 CVEs).

Top CNAs Publishing CVEs For Software Collections

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
1.01136.013.0%55