EulerOS 2.0 SP9 : curl (EulerOS-SA-2023-1862)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the 'chained' HTTP compression algorithms,...

freerdp: missing input length validation in `drive` channel

An out-of-bounds read vulnerability was discovered in FreeRDP due to improper input length validation in the drive channel. A malicious server can trick a FreeRDP based client to read out-of-bound data and send it back to the server...

freerdp: out of bounds read in zgfx decoder

An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service...

freerdp: heap buffer overflow in urbdrc channel

An out-of-bounds read vulnerability exists due to a boundary condition within the urbdrc channel. Attempting an integer addition on narrow types leads to the allocation of a buffer too small to hold the data written. A malicious server can trick a FreeRDP based client to read out-of-bound data an...

apache-commons-net: FTP client trusts the host from PASV response by default

A flaw was found in Apache Commons Net's FTP, where the client trusts the host from PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This issue could lead to leakage of...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Apache Commons Net vulnerability (USN-6037-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6037-1 advisory. ZeddYu Lu discovered that the FTP client from Apache Commons Net trusted the host from PASV responses by default. A remote...

RHEL 8 : curl (RHSA-2023:1842)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1842 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, a...

Weak Encryption

nextcloud-desktop is vulnerable to Weak Encryption. The vulnerability allows a malicious server administrator to recover and modify contents of end-to-end encrypted files...

Weak Encryption

nextcloud-desktop is vulnerable to Weak Encryption. The vulnerability allows a malicious server administrator to recover and modify contents of end-to-end encrypted files...

curl: HTTP multi-header compression denial of service

A flaw was found in the Curl package. A malicious server can insert an unlimited number of compression steps. This decompression chain could result in out-of-memory errors...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 112, which stems from a Mozilla Maintenance Service write-lock bypass, where a local attacker can trick the Mozilla Maintenance...

NewStart CGSL CORE 5.05 / MAIN 5.05 : virt-viewer Vulnerability (NS-SA-2023-0027)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has virt-viewer packages installed that are affected by a vulnerability: - Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause...

CVE-2023-26467

A man in the middle can redirect traffic to a malicious server in a compromised configuration...

CVE-2023-26467

A man in the middle can redirect traffic to a malicious server in a compromised configuration...

CVE-2023-26467

A man in the middle can redirect traffic to a malicious server in a compromised configuration...

PT-2023-20658 · Pegasystems +1 · Synchronization Engine

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A man in the middle can redirect traffic to a malicious server in a compromised configuration. Recommendations: At the moment, there is no information about a newer version that...

Pegasystem PEGA Platform 数据伪造问题漏洞

Pegasystem PEGA Platform is a suite of application development platforms from the US-based Pegasystem. The platform is used to develop applications such as BPM Business Process Management, case management, real-time decision making, and CRM Customer Relationship Management. A security vulnerabili...

SUSE CVE-2023-28997

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5...

CVE-2023-28998

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new...

UBUNTU-CVE-2023-29000

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt file...