44 matches found
CVE-2022-34265
CVE-2022-34265 脆弱性の概要 この脆弱性は、Djangoで日付データに使用される関数TruncとExtractの引数において、SQLを実行する際の不適切な文字列処理に起因します。Truncのkind引数、またはExtractのlookupname引数にリクエストパラメータがそのまま指定されることで、任意のSQL文が実行されるリスクがあります。この脆弱性を悪用すると、第三者がデータベースにコマンドを送信して、許可されていないデータにアクセスしたり、データベースを削除したりする可能性があります。...
CVE-2022-34265
CVE-2022-34265 使用方法 起動 root@kitploit: docker-compose build docker-compose up -d 停止 root@kitploit: docker-compose down Django の脆弱性 CVE-2022-34265 の PoC 検証 Django の脆弱性 CVE-2022-34265 が 2022年7月5日（米国時間）に公開されました。この記事では、本脆弱性に関する議論と検証結果について説明します。 脆弱性概要 本脆弱性は、Django で日付データに使用される関数 Trunc および Extract の引数に対...
CVE-2022-34265
CVE-2022-34265 CVE-2022-34265 の PoC 説明 Django 3.2（3.2.14 より前）および 4.0（4.0.6 より前）に問題が見つかりました。Trunc および Extract データベース関数は、信頼できないデータが kind/lookupname 値として使用された場合、SQL インジェクションの影響を受けます。lookupname と kind の選択を既知の安全なリストに制限しているアプリケーションは影響を受けません。 使用方法 起動 root@kitploit: git clone...
CTF_Django_CVE-2022-34265
CTFCVE-2022-34265 説明 Django 3.2（3.2.14より前）および 4.0（4.0.6より前）に問題が発見されました。Trunc および Extract データベース関数は、信頼できないデータが kind/lookupname 値として使用された場合、SQLインジェクションの影響を受けます。ルックアップ名と種類の選択を既知の安全なリストに制限しているアプリケーションは影響を受けません。 使い方 開始 root@kitploit: git clone https://github.com/coco0x0a/CTFCVE-2022-34265 cd...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are vulnerable to SQL injection if untrusted data is used as a kind/lookupname value. Applications that restrict the choice of lookup names and kinds to a known safe list are not...
CVE-2026-80843
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...
AZL-99422 CVE-2026-80843 affecting package kernel 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...
CVE-2026-80843
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...
CVE-2026-80843 xfrm: fix xfrm_state_construct() auth-trunc leak
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...
CVE-2026-80843: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...
Linux Distros Unpatched Vulnerability : CVE-2026-80843
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no...
CVE-2026-19730
The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails common on non-reflink-capable filesystems including many RHEL default XFS configurations, the fallback in ReflinkOrCopy uses io.Cop...
PT-2025-31762 · Iperf +2 · Iperf +2
Name of the Vulnerable Software and Affected Versions: iperf versions prior to 3.19.1 Description: The software contains a buffer overflow in net.c when the --skip-rx-copy option is used in conjunction with MSG TRUNC during the recv operation. Recommendations: Update to iperf version 3.19.1 or...
CVE-2024-6443 zephyr: out-of-bound read in utf8_trunc
In utf8trunc in zephyr/lib/utils/utf8.c, lastbytep can point to one byte before the string pointer if the string is empty...
BIT-DJANGO-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...
CLSA-2023-1698351940 vim: Fix of 2 CVEs
CVE-2023-5441: segfault in exmode - CVE-2023-5344: buffer overflow in truncstring...
CLSA-2023-1698312539 Fix CVE(s): CVE-2023-5441, CVE-2023-5344
SECURITY UPDATE: a fix of buffer-overflow in truncstring - debian/patches/CVE-2023-5344.patch - CVE-2023-5344 SECURITY UPDATE: segfault in exmode - debian/patches/CVE-2023-5441.patch - CVE-2023-5441...
SUSE CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...
python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments
A flaw was found in Django. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value...
