Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-1990)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1990 advisory. An attacker controlling an HTTP proxy or performing MITM on the plaintext pre-TLS proxy connection can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2...

CVE-2026-13122

A flaw was found in OpenVPN. A remote attacker can exploit this vulnerability by sending a malformed authentication token. This can trigger a reachable assertion when external authentication external-auth is enabled, leading to a Denial of Service DoS condition for the OpenVPN server. Mitigation ...

CVE-2026-13122

creationtimestamp| type| source ---|---|--- 2026-07-06 16:45:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyjztr2ey22 2026-07-09 20:01:35+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqagfnydfd2g...

UBUNTU-CVE-2026-13122

OpenVPN version 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled...

CVE-2026-13122

OpenVPN version 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled...

Linux Distros Unpatched Vulnerability : CVE-2026-13122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN version 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that...

Debian dsa-6376 : openvpn - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6376 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6376-1 [email protected] https://www.debian.org/securit...

CVE-2025-13122

creationtimestamp| type| source ---|---|--- 2025-11-13 19:30:37+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5jvormcmnl2...

CVE-2024-13122 AFI < 1.100.0 - Admin+ Stored XSS

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13122

The CVE-2024-13122 entry describes an issue in the AFI WordPress plugin prior to version 1.100.0 where some settings are not properly sanitised/escaped. This enables stored Cross-Site Scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (including multisite con...

CVE-2020-13122

The novish command-line interface, included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices, is vulnerable to command injection in the "show status destination ipaddr" command. This could be used by a read-only user monitoring group or admin to execute commands on the...

CVE-2020-13122

The CVE-2020-13122 entry concerns the novish command-line interface in NoviFlow NoviWare prior to NW500.2.12, deployed on NoviSwitch devices. The vulnerability is a command-injection in the CLI command “show status destination ipaddr,” allowing a read-only monitoring user or an admin to execute a...

CVE-2019-13122

A Cross Site Scripting XSS vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msg...

CVE-2019-13122

Summary: CVE-2019-13122 is a Patchwork XSS in the template tag that renders message IDs (templatetags/patch.py) across Patchwork v1.1–v2.1.x. An attacker can inject JavaScript/HTML into the patch detail page via an email to a mailing list consumed by Patchwork. Affected versions include v2.1.x an...

CVE-2019-13122

A Cross Site Scripting XSS vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msg...

CVE-2017-13122

...

CVE-2017-13122

CVE-2017-13122 is rejected and not used; this candidate does not represent an active vulnerability.

CVE-2018-13122

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete Files screen, as demonstrated by a ?i=var/www/html/&f=123.php&p=edit&p=deletefile URI...

CVE-2018-13122

CVE-2018-13122 affects OneFileCMS, specifically the vulnerable onefilecms.php up to version dated 2017-10-08. The issue permits an attacker to delete arbitrary files via the Delete File(s) screen, demonstrated by a URI pattern such as ?i=var/www/html/&f=123.php&p=edit&p=deletefile. Root cause ide...