CVE-2022-24754 Buffer overflow in pjsip

PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials credentials with datatype PJSIPCREDDATADIGEST...

PT-2022-2678 · Pjsip +4 · Pjsip +4

Name of the Vulnerable Software and Affected Versions: PJSIP versions prior to and including 2.12 Description: The issue is a stack-buffer overflow vulnerability in the PJSIP library, which only impacts users who accept hashed digest credentials with data type PJSIP CRED DATA DIGEST. This...

GnuTLS 代码问题漏洞

GnuTLS is a free secure communication library for implementing SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS that stems from a null pointer dereference in MDUPDATE...

Weekly Threat Digest: 21-27 February 2022

...

Weekly Threat Digest: 14-20 February 2022

...

VulnCheck KEV: CVE-2017-9788

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in Proxy-Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by modauthdigest. Providing an initial key with no '=' assignment could reflect the...

ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network...

PYSEC-2022-38

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobble...

PT-2021-8817 · Apereo · Apereo Opencast

Name of the Vulnerable Software and Affected Versions: Apereo Opencast versions 4.x through 10.x before 10.6 Description: An issue was discovered in Apereo Opencast where it sends system digest credentials during authentication attempts to arbitrary external services in some situations. This occu...

Belloo 安全特征问题漏洞

Belloo, a "high quality" dating software from Belloo, is vulnerable to an access control error that originates from the use of md5$time to generate password recovery code in requestsuser.php. An attacker could use this vulnerability to predict the time value on the server and could easily guess t...

Medium: containerd, docker

Issue Overview: In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby Docker Engine prior to 20.10.11 and versions of...

tpm2-tools security and enhancement update

4.1.1-5 - Bump nvr to trigger osci. resolves: rhbz1965981 4.1.1-4 - Fix CVE-2021-3565 resolves: rhbz1965981 4.1.1-3 - Fix resource leak. - Fix to restrict policy digest size. - Fix incompatible pointer cast. - Fix error message in filesloadname - Fix issue where execution couldnt reach function...

httpd: Single zero byte stack overflow in mod_auth_digest

A flaw was found in Apache httpd. The modauthdigest has a single zero byte stack overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

httpd: Single zero byte stack overflow in mod_auth_digest

A flaw was found in Apache httpd. The modauthdigest has a single zero byte stack overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

EnroCrypt 加密问题漏洞

EnroCrypt is This is a Python module for encryption, hashing, and other essentials you need to hash via secure encryption and imposed salt. A security vulnerability exists in versions prior to EnroCrypt 1.1.4 that stems from EnroCrypt's use of the MD5 hashing algorithm in hash files, which is...

Apache Tomcat 7.0.x < 7.0.11 Multiple Vulnerabilities - Linux

Apache Tomcat is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Apache Tomcat 5.5.x < 5.5.34 Multiple Vulnerabilities - Linux

Apache Tomcat is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Apache Tomcat 6.x < 6.0.36 Multiple Vulnerabilities (Oct 2012) - Linux

Apache Tomcat is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Apache Tomcat 7.0.x < 7.0.29 Multiple Vulnerabilities - Linux

Apache Tomcat is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CLSA-2021-1635459129 Fix CVE(s): CVE-2021-26690, CVE-2021-26691, CVE-2021-30641, CVE-2020-35452

SECURITY UPDATE: Unexpected URL matching with 'MergeSlashes OFF' - debian/patches/CVE-2021-30641.patch: legacy default slash-matching behavior with 'MergeSlashes OFF'. - CVE-2021-30641 SECURITY UPDATE: heap overflow in modsession - debian/patches/CVE-2021-26691.patch: A specially crafted...