1038 matches found
DEBIAN-CVE-2022-39264
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...
CVE-2022-36781
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repeatedly attempting...
AZL-11001 CVE-2022-38177 affecting package bind for versions less than 9.16.33-1
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources...
AZL-10999 CVE-2022-2795 affecting package bind for versions less than 9.16.33-1
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service...
DEBIAN-CVE-2021-42948
HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's...
AZL-10921 CVE-2022-40674 affecting package expat for versions less than 2.4.8-2
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c...
AZL-43341 CVE-2021-43565 affecting package cri-o for versions less than 1.22.3-5
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...
CVE-2022-36555
Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack...
AZL-10863 CVE-2022-1117 affecting package fapolicyd for versions less than 1.3.2-1
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker...
AZL-35153 CVE-2021-4158 affecting package qemu for versions less than 6.2.0-18
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition...
AZL-10617 CVE-2022-2873 affecting package kernel for versions less than 5.15.70.1-1
An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2CSMBUSBLOCKDATA with the ioctl I2CSMBUS with malicious input data. This flaw allows a local user to crash the system...
prometheus/client_golang: Denial of service using InstrumentHandlerCounter
A denial of service attack was found in prometheus/clientgolang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability...
AZL-34947 CVE-2021-33644 affecting package libtar for versions less than 1.2.20-11
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulongname, causing an out-of-bounds read...
AZL-34948 CVE-2021-33645 affecting package libtar for versions less than 1.2.20-11
The thread function doesn’t free a variable t-thbuf.gnulonglink after allocating memory, which may cause a memory leak...
AZL-10445 CVE-2022-2580 affecting package vim for versions less than 9.0.0325-1
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102...
AZL-10103 CVE-2022-32207 affecting package curl for versions less than 7.84.0-1
When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...
AZL-41344 CVE-2022-1996 affecting package sriov-network-device-plugin for versions less than 3.7.0-1
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0...
AZL-9877 CVE-2022-27782 affecting package curl for versions less than 7.83.1-1
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...