Improper Upper Bound Definition on the Fee

Handle defsec Vulnerability details Impact In the adjustGlobalParams function on line 1603of "", adjustGlobalParams function does not have any upper or lower bounds. Values that are too large will lead to reversions in several critical functions. Proof of Concept The setFee function that begins o...

Excessive require makes the transaction fail unexpectedly

Handle WatchPug Vulnerability details The check for RENCRVVAULT.blockLock is only needed when if amounts1 0 || amounts2 0. However, in the current implementation, the check is done at the very first, making transactions unrelated to RENCRVVAULT fail unexpectedly if there is a prior transaction...

The Best Ransomware Response, According to the Data

Ransomware has become part of the cost of doing business, and driving down that cost can be the difference between recovery and catastrophe. A data analysis from Fox-IT, part of NCC Group, offers some best practices for how to minimize the fallout of a ransomware attack, after creating a dataset ...

dnsmasq: fixed outgoing port used when --server is used with an interface name

A flaw was found in dnsmasq. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and...

CVE-2021-20702

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code...

Input validation

Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to rea...

Buffer overflow

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code...

Buffer overflow

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code...

CVE-2021-20707

Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to rea...

CVE-2021-20707

CVE-2021-20707 is an input-validation vulnerability in NEC ClusterPRO X and EXPRESSCLUSTER X, specifically affecting the Transaction Server. Multiple sources (NVD/NJC/JVN/Red Hat, PRION) describe that versions up to 4.3 for Windows and earlier, including 4.3 SingleServerSafe variants, allow a rem...

CVE-2021-20703

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code...

CVE-2021-20703

CVE-2021-20703 is a buffer overflow vulnerability in NEC CLUSTERPRO X and EXPRESSCLUSTER X, affecting the Transaction Server on Windows up to version 4.3 (and SingleServerSafe variants). The root cause is memory/bounds corruption in the Transaction Server allowing remote code execution via networ...

CVE-2021-20702

CVE-2021-20702 is a buffer overflow vulnerability in NEC CLUSTERPRO X/EXPRESSCLUSTER X products. The Transaction Server component in CLUSTERPRO X 4.3 for Windows and earlier, and EXPRESSCLUSTER X 4.3 for Windows and earlier (including SingleServerSafe variants) is affected, with the underlying is...

PT-2021-14161

Name of the Vulnerable Software and Affected Versions: CLUSTERPRO X versions 4.3 and earlier EXPRESSCLUSTER X versions 4.3 and earlier CLUSTERPRO X SingleServerSafe versions 4.3 and earlier EXPRESSCLUSTER X SingleServerSafe versions 4.3 and earlier Description: The issue allows an attacker to...

PT-2021-14162

Name of the Vulnerable Software and Affected Versions: CLUSTERPRO X versions 4.3 and earlier EXPRESSCLUSTER X versions 4.3 and earlier CLUSTERPRO X SingleServerSafe versions 4.3 and earlier EXPRESSCLUSTER X SingleServerSafe versions 4.3 and earlier Description: The issue allows an attacker to...

PT-2021-14166

Name of the Vulnerable Software and Affected Versions: CLUSTERPRO X versions 4.3 and earlier EXPRESSCLUSTER X versions 4.3 and earlier CLUSTERPRO X SingleServerSafe versions 4.3 and earlier EXPRESSCLUSTER X SingleServerSafe versions 4.3 and earlier Description: The issue is related to improper...

CVE-2021-20707: Improper Input Validation

Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to rea...

CVE-2021-20703: Buffer Copy without Checking Size of Input

Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code...

Multiple vulnerabilities in CLUSTERPRO X and EXPRESSCLUSTER X

Overview CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain multiple vulnerabilities listed below. Buffer overflow in the Disk Agent CWE-119 - CVE-2021-20700, CVE-2021-20701 Buffer overflow in the Transaction Server CWE-119 - CVE-2021-20702, CVE-2021-20703 Buffer overflow in th...

NEC Corporation CLUSTERPRO 缓冲区错误漏洞

NEC Corporation CLUSTERPRO is an HA clustering software from NEC. A buffer error vulnerability exists in NEC Corporation CLUSTERPRO X version 1.0 and EXPRESSCLUSTER X version 1.0 that originates from a boundary error in the software transaction server. A remote attacker could exploit the...