CVE-2020-15473

In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpisearchopenvpn in lib/protocols/openvpn.c...

CVE-2020-15474

In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c...

CVE-2020-15474

CVE-2020-15474 affects the nDPI library (through version 3.2 and earlier) with a stack overflow in extractRDNSequence within lib/protocols/tls.c. Multiple connected sources (CNVD, SUSE, OSV, CNVD-like entries) confirm the vulnerable component and function, indicating a buffer/stack overflow risk ...

CVE-2020-15475

In nDPI through 3.2, ndpiresetpacketlineinfo in lib/ndpimain.c omits certain reinitialization, leading to a use-after-free...

CVE-2020-15476

In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpisearchoracle in lib/protocols/oracle.c...

PT-2020-14442

Name of the Vulnerable Software and Affected Versions nDPI versions prior to 3.2 Description The issue arises from the ndpi reset packet line info function in lib/ndpi main.c, which fails to properly reinitialize certain data, resulting in a use-after-free situation. Recommendations For versions...

PT-2020-14441

Name of the Vulnerable Software and Affected Versions nDPI versions prior to 3.2 Description There is a stack overflow issue in the extractRDNSequence function located in lib/protocols/tls.c. Recommendations For versions prior to 3.2, update to version 3.2 or later to resolve the issue...

CVE-2020-15473: Out-of-bounds Read

In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpisearchopenvpn in lib/protocols/openvpn.c...

CVE-2020-15471: Out-of-bounds Read

In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpiparsepacketlineinfo in lib/ndpimain.c...

CVE-2020-15472: Out-of-bounds Read

In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpisearchh323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short...

CVE-2020-15474: Out-of-bounds Write

In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c...

CVE-2020-15476: Out-of-bounds Read

In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpisearchoracle in lib/protocols/oracle.c...

CVE-2020-15475: Use After Free

In nDPI through 3.2, ndpiresetpacketlineinfo in lib/ndpimain.c omits certain reinitialization, leading to a use-after-free...

USN-4400-1: nfs-utils vulnerability

It was discovered that the nfs-utils package set incorrect permissions on the /var/lib/nfs directory. An attacker could possibly use this issue to escalate privileges...

CVE-2020-14422

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface...

CVE-2020-14422

CVE-2020-14422 affects the Python ipaddress module (IPv4Interface/IPv6Interface) where improper hash computation can cause a DoS by creating many dictionary entries due to performance of dictionaries containing those objects. The issue is documented for Lib/ipaddress.py up to Python 3.8.3, with f...

Remote code execution

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution...

CVE-2020-7673

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument "A" of "extend" function"A,B,as,isAargs" located within "lib/extend.js" is executed by the "eval" function, resulting in code execution...

PT-2020-4204

Name of the Vulnerable Software and Affected Versions: node-extend versions prior to 0.2.1 Description: The issue concerns the extend function located within lib/extend.js, where user input provided to the argument A is executed by the eval function, resulting in arbitrary code execution. This is...

CVE-2020-7673: Improper Control of Generation of Code

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument A of extend functionA,B,as,isAargs located within lib/extend.js is executed by the eval function, resulting in code execution...