321 matches found
CVE-2021-44492: NULL Pointer Dereference
An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, attackers can cause a type to be incorrectly initialized in the function fincr in srport/fincr.c and cause a crash due to a NULL pointer dereference...
CVE-2021-44504: Incorrect Calculation
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause a size variable, stored as an signed int, to equal an extremely large value, which is interpreted as a negative value during a check. This value is then used in a memc...
CVE-2021-44505: NULL Pointer Dereference
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause a NULL pointer dereference after calls to ZPrint...
CVE-2021-44503: Improper Restriction of Operations within the Bounds of a Memory Buffer
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause a call to vaarg on an empty variadic parameter list, most likely causing a memory segmentation fault...
CVE-2021-44502: Allocation of Resources Without Limits or Throttling
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can control the size of a memset that occurs in calls to utilformat in srunix/utiloutput.c...
PT-2022-12142
Name of the Vulnerable Software and Affected Versions YottaDB versions through r1.32 and V7.0-000 FIS GT.M versions through V7.0-000 Description An issue allows an attacker to cause a NULL pointer dereference after calls to ZPrint using crafted input. Recommendations For YottaDB versions through...
FIS GT.M数字错误漏洞
FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which stems from a lack of input validation when calling ebdiv in srport/ebmuldiv.c. An attacker can exploit the vulnerability to crash the application by performing a divide by zero...
CVE-2021-44500: Divide By Zero
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. A lack of input validation in calls to ebdiv in srport/ebmuldiv.c allows attackers to crash the application by performing a divide by zero...
FIS GT.M 代码问题漏洞
FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which stems from a lack of parameter validation when calling memcpy in strtok in srunix/ztimeoutroutines.c. The vulnerability can be exploited to attempt to read a null pointer. An attacker ca...
FIS GT.M 代码问题漏洞
FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which stems from a missing NULL check in the call to iousopen in srunix/iousopen.c. The vulnerability can be exploited to crash an application by dereferencing a NULL pointer. An attacker can...
PT-2022-12149 · Fis +3 · Fis Gt.M +3
Name of the Vulnerable Software and Affected Versions: FIS GT.M versions prior to V7.0-000 Description: An issue was discovered related to the YottaDB code base. Using crafted input, an attacker can control the size of a memset that occurs in calls to util format in sr unix/util output.c...
FIS GT.M 代码问题漏洞
FIS GT.M is a database platform. A security vulnerability exists in FIS GT.M versions prior to V7.0-000, which stems from the lack of input validation in the call to doverify in srunix/doverify.c. The vulnerability can be exploited to attempt to jump to a NULL pointer by corrupting the function...
PT-2022-12144
Name of the Vulnerable Software and Affected Versions FIS GT.M versions through V7.0-000 Description An issue was discovered related to the YottaDB code base. Using crafted input can cause the bounds of a for loop to be miscalculated, leading to a use after free condition where a pointer is pushe...
PT-2022-12146
Name of the Vulnerable Software and Affected Versions FIS GT.M versions prior to V7.0-000 Description An issue was discovered related to the YottaDB code base, where crafted input can cause a buffer overflow. This occurs when a call to $Extract forces a signed integer holding the size of a buffer...
CVE-2021-44499: Improper Restriction of Operations within the Bounds of a Memory Buffer
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause a call to $Extract to force an signed integer holding the size of a buffer to take on a large negative number, which is then used as the length of a memcpy call that...
CVE-2021-44494: NULL Pointer Dereference
An issue was discovered in YottaDB through r1.32 and V7.0-000 and FIS GT.M through V7.0-000. Using crafted input, an attacker can cause calls to ZRead to crash due to a NULL pointer dereference...
CVE-2021-44501: NULL Pointer Dereference
An issue was discovered in FIS GT.M through V7.0-000 related to the YottaDB code base. Using crafted input, an attacker can cause calls to ZRead to crash due to a NULL pointer dereference...
CVE-2021-3735
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset ahciresetport while handling a host-to-device Register FIS Frame Information Structure packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host...
PT-2021-15462
Name of the Vulnerable Software and Affected Versions fis-kernel affected versions not specified Description The issue affects the util.nohup function in fis3, which is vulnerable to command injection in non-windows systems, such as Linux. Recommendations At the moment, there is no information...
fis-gmbh.de Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1186898 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...