CVE-2022-27939

tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in getlayer4v6 in common/get.c...

CVE-2022-27942

tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parsempls in common/get.c...

CVE-2022-27941

tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in getl2lenprotocol in common/get.c...

PT-2022-18707 · Tcpreplay +2 · Tcpreplay +2

Name of the Vulnerable Software and Affected Versions: Tcpreplay version 4.4.1 Description: The issue is related to a reachable assertion in the get layer4 v6 function located in common/get.c. This assertion is reachable in tcprewrite, a component of Tcpreplay. Recommendations: For Tcpreplay...

CVE-2022-27941

tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in getl2lenprotocol in common/get.c...

CVE-2022-27941

CVE-2022-27941 affects Tcpreplay v4.4.1 (tcprewrite) with a heap-based buffer over-read in get_l2len_protocol in common/get.c. The issue is addressed in later Tcpreplay versions (e.g., 4.4.2) per security advisories (ALT Linux/Mageia) and package updates; upgrade to 4.4.2+ to mitigate. Exploitati...

CVE-2022-27939

CVE-2022-27939 affects Tcpreplay (Tcprewrite) 4.4.1, with a reachable assertion in get_layer4_v6 in common/get.c. Multiple connected sources corroborate the issue, including the core description: “tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c.” The issue...

CVE-2022-27939

tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in getlayer4v6 in common/get.c...

PT-2022-17319 · Tcpprep +2 · Tcpprep +2

Name of the Vulnerable Software and Affected Versions: tcpprep version 4.4.1 Description: The issue is related to a reachable assertion in the packet2tree function at tree.c in tcpprep. This assertion is assertl2len 0, indicating a potential problem when the l2len variable is not greater than 0...

Security fix for the ALT Linux 9 package tcpreplay version 4.4.1-alt1

4.4.1-alt1 built March 9, 2022 Anton Farygin in task 295834 Feb. 23, 2022 Anton Farygin - 4.4.1 Fixes: CVE-2021-45387, CVE-2021-45386...

PT-2021-24346 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions 3.2.0 through 4.4.0 Description: The issue concerns initializer functions that are invoked separate from contract creation, such as minimal proxies, which may be reentered if they make an untrusted non-view...

CVE-2021-32651

OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The...

Design/Logic Flaw

OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The...

CVE-2021-32651 LDAP injection via OneDev may leak some LDAP directory information

OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The...

PT-2021-14476 · Ampache · Ampache

Name of the Vulnerable Software and Affected Versions: Ampache versions prior to 4.4.1 Description: The issue allows unauthenticated access to Ampache using the subsonic API. To exploit this, an attacker must use a username that is not part of the site to bypass the auth checks. Recommendations:...

CVE-2020-27207

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlciphercodecpragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data...

CVE-2020-27207

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlciphercodecpragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data...

MongoDB Security Vulnerabilities

MongoDB is a document-oriented database management system from the American company MongoDB. A security vulnerability exists in MongoDB Server versions 4.4 through 4.4.1, which originates from the possibility that a user authorized to perform a database query may be able to cause a denial of...

PT-2020-16662 · Zetetic +1 · Sqlcipher +1

Name of the Vulnerable Software and Affected Versions: Zetetic SQLCipher versions 4.x before 4.4.1 Description: The issue is related to a use-after-free error, specifically involving sqlcipher codec pragma and sqlite3Strlen30 in sqlite3.c. This can lead to a remote denial of service attack. An...

BaserCMS Cross-Site Scripting Vulnerability (CNVD-2020-60477)

BaserCMS is an open source enterprise-level content management system cms. A cross-site scripting vulnerability exists in versions of baserCMS prior to 4.4.1. An attacker can exploit this vulnerability by entering a specially crafted nickname in a blog comment to execute arbitrary JavaScript...