CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

golang.org/x/crypto: empty plaintext packet causes panic

There's an input validation flaw in golang.org/x/crypto's readCipherPacket function. An unauthenticated attacker who sends an empty plaintext packet to a program linked with golang.org/x/crypto/ssh could cause a panic, potentially leading to denial of service...

mtail:vm-fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4663401648881664 Project: mtail Fuzzing Engine: libFuzzer Fuzz Target: vm-fuzzer Job Type: libfuzzerasanmtail Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

GSD-2022-1004920 xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue

xen/netback: avoid entering xenvifrxnextskb with an empty rx queue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.324 by commit...

GSD-2022-1004869 xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue

xen/netback: avoid entering xenvifrxnextskb with an empty rx queue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.289 by commit...

GSD-2022-1004801 xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue

xen/netback: avoid entering xenvifrxnextskb with an empty rx queue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.253 by commit...

GSD-2022-1004417 xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue

xen/netback: avoid entering xenvifrxnextskb with an empty rx queue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.56 by commit...

PT-2022-33131

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.289 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility...

PT-2022-33063

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v4.19.253 Description The issue is related to the xen/netback component, where it may enter the xenvif rx next skb function with an empty rx queue. The actual impact and attack plausibility have not yet been prove...

PT-2022-32463

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v5.18.13 Description The issue is related to the xen/netback component, where it may enter the xenvif rx next skb function with an empty rx queue. The actual impact and attack plausibility have not yet been proven...

PT-2022-33182

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.324 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility ha...

PT-2022-32974

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v5.4.207 Linux Kernel versions v4.9 through v5.4.206 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb. It is possible to enter this function with an...

PT-2022-32849

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.132 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility...

go-ethereum:fuzzTxfetcher: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6701473429323776 Project: go-ethereum Fuzzing Engine: libFuzzer Fuzz Target: fuzzTxfetcher Job Type: libfuzzerasango-ethereum Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: address...

crossplane:fuzz_parse: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6517735198162944 Project: crossplane Fuzzing Engine: libFuzzer Fuzz Target: fuzzparse Job Type: libfuzzerasancrossplane Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00c8248c6f0f Crash State: NULL Sanitizer: address ASAN Recommende...

github_scarecrow:scarecrow: Command injection with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5591770330693632 Project: githubscarecrow Fuzzing Engine: libFuzzer Fuzz Target: scarecrow Job Type: libfuzzerasangithubscarecrowtest Platform Id: linux Crash Type: Command injection Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...

tinygltf:fuzz_gltf: Command injection with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5114449895227392 Project: tinygltf Fuzzing Engine: libFuzzer Fuzz Target: fuzzgltf Job Type: libfuzzerasantinygltf Platform Id: linux Crash Type: Command injection Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

CVE-2022-26117

An empty password in configuration file vulnerability CWE-258 in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI...

CVE-2022-26117

An empty password in configuration file vulnerability CWE-258 in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI...