CVE-2024-23184

Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors...

CVE-2024-23184

CVE-2024-23184 affects the Dovecot IMAP/POP3 server. The root issue is that parsing a large number of email address headers (From, To, Cc, Bcc, etc.) is highly CPU-intensive, leading to potential denial of service when attackers send crafted messages that trigger resource exhaustion. The availabl...

CVE-2024-29948

There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted messages to a vulnerable device, causing a service abnormality...

CVE-2024-29948

The CVE-2024-29948 entry concerns Hikvision Network Video Recorders (NVRs) with an out-of-bounds read vulnerability. The vulnerability is described as exploitable by an authenticated attacker who can send specially crafted messages to a vulnerable device, leading to a service abnormality. The ava...

CVE-2024-29947

There is a NULL dereference pointer vulnerability in some Hikvision NVRs. Due to an insufficient validation of a parameter in a message, an attacker may send specially crafted messages to an affected product, causing a process abnormality...

Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by specially crafted PCF or MQSC messages. (CVE-2022-43902)

Summary An issue was identified within the IBM MQ Server component that would allow an authenticated attacker with sufficient MQ permissions to send MQSC or PCF commands to execute a denial of service attack by sending specially crafted payload. Vulnerability Details CVEID:CVE-2022-43902...

CVE-2023-0361

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to...

Stack overflow

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted time reduced data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe...

Stack overflow

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted setting value messages. Affected Products: IGSS Data Server - IGSSdataServer.exe Version...

Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue

A flaw was found in Mozilla. According to the Mozilla Foundation Security Advisory, Thunderbird users who use the Matrix chat protocol are vulnerable to a data corruption issue. An attacker could potentially cause data integrity issues by sending specially crafted messages...

Cisco Jabber Client For MacOS XMPP Stanza Smuggling (cisco-sa-jabber-xmpp-Ne9SCM)

According to its self-reported version, Cisco Jabber for MacOS is affected by a stanza smuggling vulnerability due to improper handling of nested XMPP requests. An authenticated, remote attacker can send specially crafted XMPP messages to an affected client causing the client to perform unsafe...

The vulnerability of the Data Server database in the interactive graphical SCADA system, allowing a intruder to execute arbitrary code.

The vulnerability of the Data Server database in the Interactive Graphical SCADA System IGSS involves copying buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted messages...

CVE-2020-20094

Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages...

Security Bulletin: Multiple IBM MQ vulnerabilities affect IBM Sterling Global Mailbox

Summary IBM MQ is shipped with IBM Sterling Global Mailbox. Multiple vulnerabilities impacts IBM MQ. Remediation is available for the issues. Vulnerability Details CVEID: CVE-2019-4227 DESCRIPTION: IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners...

CVE-2020-7034

A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for...

IBM MQ 7.1 <= 7.1.0.9 / 7.5 <= 7.5.0.9 / 8.0 <= 8.0.0.11 / 9.0 <= 9.0.0.6 LTS / 9.1 <= 9.1.0.2 LTS / 9.1 <= 9.1.2 CD (886887)

The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013. Note that...

Buffer overflow

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client spice-gtk and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messag...

Cisco Jabber for Windows Information Disclosure (cisco-sa-jabber-ttcgB9R3)

According to its self-reported version, Cisco Jabber is affected by a information disclosure vulnerability. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful...

CVE-2019-4261

IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013...

IBM MQ Denial of Service Vulnerability (CNVD-2019-26703)

IBM MQ IBM WebSphere MQ is a messaging middleware product from IBM. The product is mainly for the service-oriented architecture SOA to provide a reliable and proven messaging backbone. A denial of service vulnerability exists in IBM MQ, which can be exploited by an attacker to cause a denial of...