6446 matches found
PT-2023-14985 · Dell · Wyse Management Suite
Name of the Vulnerable Software and Affected Versions: Wyse Management Suite Repository versions 3.8 and below Description: The issue allows an unauthenticated attacker to potentially discover the internal structure of the application and its components, which could be used for further...
AZL-13289 CVE-2022-43552 affecting package rust for versions less than 1.72.0-2
A use after free vulnerability exists in curl 7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can and often do deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocat...
UBUNTU-CVE-2023-22795
A regular expression based DoS vulnerability in Action Dispatch 6.1.7.1 and 7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This...
AZL-13352 CVE-2023-0215 affecting package openssl for versions less than 1.1.1k-21
The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the...
AZL-13353 CVE-2023-23931 affecting package python-cryptography for versions less than 3.3.2-4
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects such as bytes to b...
VulnCheck KEV: CVE-2020-6008
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution...
AZL-13170 CVE-2023-0394 affecting package kernel for versions less than 5.15.92.1-1
A NULL pointer dereference flaw was found in rawv6pushpendingframes in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash...
AZL-13204 CVE-2022-3094 affecting package bind for versions less than 9.16.37-2
Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions ACLs and is...
AZL-35289 CVE-2022-38725 affecting package syslog-ng for versions less than 4.3.1-2
An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected...
AZL-13115 CVE-2022-47015 affecting package mariadb for versions less than 10.6.9-3
MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spiderdbmbase::printwarnings to dereference a null pointer...
CVE-2023-23490
The Survey Maker WordPress Plugin, version 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveysids' parameter of its 'ayssurveysexportjson' action...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the ifnonematch header in http/cache.rb. An attacker can cause resource exhaustion with a malicious If-None-Match header if a version of Ruby below 3.2.0 is in use. NOTE: Patches have been...
AZL-13026 CVE-2022-41903 affecting package git for versions less than 2.33.8-2
Git is distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is a integer overflow in...
AZL-13063 CVE-2022-41861 affecting package freeradius for versions less than 3.2.3-1
A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash...
AZL-13029 CVE-2022-41721 affecting package opa for versions less than 0.50.2-5
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be...
AZL-37016 CVE-2022-3437 affecting package samba for versions less than 4.18.3-1
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrapdes and unwrapdes3 routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc allocated memory when presented with a...
AZL-13006 CVE-2023-23454 affecting package kernel for versions less than 5.15.87.1-1
cbqclassify in net/sched/schcbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service slab-out-of-bounds read because of type confusion non-negative numbers can sometimes indicate a TCACTSHOT condition rather than valid classification results...
AZL-12970 CVE-2022-4415 affecting package systemd for versions less than 250.3-13
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suiddumpable kernel setting...
AZL-35293 CVE-2022-4415 affecting package systemd-bootstrap for versions less than 250.3-15
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suiddumpable kernel setting...