Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

The plugin did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an SQL Injection issues Via...

Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection

The plugin did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an SQL Injection issues PoC Via...

The vulnerability of the astra-safepolicy security configuration software, related to access control deficiencies. Exploiting this vulnerability allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the astra-safepolicy security configuration software relates to the disabling of the MAC mode. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the software used to create the private virtual network astra-openvpn-server lies in errors in the authentication process, which allow a perpetrator to cause service interruptions.

The software vulnerability related to the creation of a private virtual network, astra-openvpn-server, is caused by an error in certificate rehydration. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the `parsec inode_post_xattr` function in the Linux kernel modules, related to improper memory release, allows a hacker to trigger a service failure.

The vulnerability of the parsec inodepostxattr function in the Linux-Astra-modules is related to a variable overflow, which subsequently leads to a null-ptr-deref error. Exploiting this vulnerability allows an attacker to cause service failures...

The vulnerability of the software used to create the private virtual network astra-openvpn-server, related to its configuration, allows a hacker to trigger a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to incorrect configuration of IP addresses. Exploiting this vulnerability allows a malicious actor to cause service interruptions...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, related to code errors, allows a intruder to trigger a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to a code error that prevents the /etc/openvpn/keys/ directory from being created. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the FreeIPA Astra-freeipa certificate creation and update tool is related to an unreliable search process, which allows a perpetrator to compromise the integrity of the data.

The vulnerability of the FreeIPA Astra-freeipa certificate creation and renewal tool is related to improper searching for existing keys. Exploiting this vulnerability allows a remote attacker to compromise the integrity of data...

The vulnerability of the astra-safepolicy software for security configuration settings, due to insufficient input validation, allows a perpetrator to trigger a service failure.

The vulnerability of the astra-safepolicy security configuration software is related to incorrect data processing in the stderr output. Exploiting this vulnerability allows a remote attacker to cause service failures...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, related to integer overflows, allows a hacker to cause a service failure.

The vulnerability of the software used to create the private virtual network astra-openvpn-server is related to improperly defined variable boundaries. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the `pdprl_get_from_raw_lbl` function in the Linux-astra-modules kernel module, related to improper memory release, allows a hacker to trigger a service failure.

The vulnerability of the pdprlgetfromrawlbl function in the linux-astra-modules kernel module is related to an improper check of the raw parameter. This leads to a slab-out-of-bounds error later on. Exploiting this vulnerability allows an attacker to cause service failures...

The vulnerability of the software for creating a private virtual network, astra-openvpn-server, relates to the bypass of authentication due to a fundamental error. This allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the software used to create the private virtual network astra-openvpn-serve is related to the improper creation of certificates, which are generated without authentication parameters. Exploiting this vulnerability allows a malicious actor to gain access to confidential data,...

The vulnerability of the astra-safepolicy software for security configuration involves insufficient data processing within the security mechanisms, allowing attackers to trigger a service failure.

The vulnerability of the astra-safepolicy security configuration software is related to incorrect data processing in the /etc/fstab file. Exploiting this vulnerability allows an attacker to cause service failures...

PT-2021-30929

Уязвимость инструмента для создания и обновления сертификатов FreeIPA Astra-freeipa связана с некорректным поиском существующих ключей. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, оказать воздействие на целостность данных...

PT-2021-30928

Уязвимость программного обеспечения для создания частной виртуальной сети astra-openvpn-server связанная с ошибкой кода, при которой не создается каталог /etc/openvpn/keys/. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, вызвать отказ в обслуживании...

PT-2021-30949

Уязвимость функции pdpl put модуля ядра linux-astra-modules связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

PT-2021-30920

Уязвимость программного обеспечения для настройки безопасности astra-safepolicy связанна с отключением режима МКЦ. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании...

PT-2021-30926

Уязвимость программного обеспечения для настройки безопасности astra-safepolicy связанна с не корректным включением блокировки одновременной работы с разными уровнями в пределах одной сессии. Эксплуатация уязвимости позволяет нарушителю, действующему удаленно, получить доступ к конфиденциальным...

PT-2021-3799

Name of the Vulnerable Software and Affected Versions Astra Linux affected versions not specified Description The issue is related to the display of modal windows from third-party applications such as МИС "Медиалог" over the Astra Linux lock screen. This could potentially allow an attacker to gai...

PT-2021-30946

Уязвимость функции pdpml get new модуля ядра linux-astra-modules связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...