4236 matches found
Stack overflow
Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row...
CVE-2020-24342
Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row...
CVE-2020-24342
Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row...
CVE-2020-24342
Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row...
CVE-2020-24342
Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row...
CVE-2020-24342
CVE-2020-24342 concerns Lua up to version 5.4.0 where a stack redzone cross is possible in luaO_pushvfstring because a protection mechanism incorrectly calls luaD_callnoyield twice in a row. The provided sources (NVD/NVD-based entries and related advisories) describe the issue's root cause as thi...
PT-2020-15693
Name of the Vulnerable Software and Affected Versions Lua versions prior to 5.4.1 Description The issue allows a stack redzone cross in luaO pushvfstring due to a protection mechanism wrongly calling luaD callnoyield twice in a row. Recommendations For Lua versions prior to 5.4.1, update to versi...
CVE-2020-24342: Improper Restriction of Operations within the Bounds of a Memory Buffer
Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row...
PT-2020-5337
Name of the Vulnerable Software and Affected Versions D-Link DSR-150 versions 3.14 through 3.17 D-Link DSR-250 versions 3.14 through 3.17 D-Link DSR-500 versions 3.14 through 3.17 D-Link DSR-1000AC versions 3.14 through 3.17 Description A lack of input validation and access controls in Lua CGIs o...
CVE-2020-13151
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...
CVE-2020-13151
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...
Remote code execution
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...
CVE-2020-13151
CVE-2020-13151 affects the Aerospike Community Edition, specifically versions around 4.9.0.5. The vulnerability allows an unauthenticated user to submit a crafted Lua UDF that can execute arbitrary OS commands via os.execute(), enabling remote command execution on all cluster nodes with the Aeros...
CVE-2020-13151
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...
CVE-2020-13151
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...
CVE-2020-13151: Improper Neutralization of Special Elements used in an OS Command
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute calls, but this is insufficient. Anyone with network access can use a...
PT-2020-13356 · Aerospike · Aerospike Community Edition
Name of the Vulnerable Software and Affected Versions: Aerospike Community Edition version 4.9.0.5 Description: The issue allows for unauthenticated submission and execution of user-defined functions UDFs, written in Lua, as part of a database query. Although it attempts to restrict code executio...
Aerospike Database UDF Lua Code Execution
Aerospike Database versions before 5.1.0.3 permitted user-defined functions UDF to call the os.execute Lua function. This module creates a UDF utilising this function to execute arbitrary operating system commands with the privileges of the user running the Aerospike service. This module does not...
