bootstrap_os Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/bootstrap_os/ Sun, 26 Feb 2023 06:41:40 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png bootstrap_os Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/bootstrap_os/ 32 32 CVE-2020-36516 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-36516/ Sun, 26 Feb 2023 06:41:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-36516/ An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim’s TCP session or terminate that session.

The post CVE-2020-36516 appeared first on CVE Vulnerability.

]]> An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim’s TCP session or terminate that session.

The post CVE-2020-36516 appeared first on CVE Vulnerability.

]]> CVE-2019-17498 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-17498/ Sun, 26 Feb 2023 06:31:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-17498/ In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system […]

The post CVE-2019-17498 appeared first on CVE Vulnerability.

]]> In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

The post CVE-2019-17498 appeared first on CVE Vulnerability.

]]> CVE-2021-3753 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3753/ Thu, 23 Feb 2023 14:10:57 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3753/ A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.

The post CVE-2021-3753 appeared first on CVE Vulnerability.

]]> A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.

The post CVE-2021-3753 appeared first on CVE Vulnerability.

]]> CVE-2022-32208 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-32208/ Thu, 23 Feb 2023 05:19:01 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-32208/ When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

The post CVE-2022-32208 appeared first on CVE Vulnerability.

]]> When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

The post CVE-2022-32208 appeared first on CVE Vulnerability.

]]> CVE-2022-23308 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-23308/ Thu, 23 Feb 2023 05:03:01 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-23308/ valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

The post CVE-2022-23308 appeared first on CVE Vulnerability.

]]> valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

The post CVE-2022-23308 appeared first on CVE Vulnerability.

]]> CVE-2022-22576 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-22576/ Thu, 23 Feb 2023 05:02:51 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-22576/ An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

The post CVE-2022-22576 appeared first on CVE Vulnerability.

]]> An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

The post CVE-2022-22576 appeared first on CVE Vulnerability.

]]> CVE-2022-21476 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-21476/ Thu, 23 Feb 2023 05:02:34 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-21476/ Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java […]

The post CVE-2022-21476 appeared first on CVE Vulnerability.

]]> Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The post CVE-2022-21476 appeared first on CVE Vulnerability.

]]> CVE-2022-21496 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-21496/ Thu, 23 Feb 2023 05:02:34 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-21496/ Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java […]

The post CVE-2022-21496 appeared first on CVE Vulnerability.

]]> Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

The post CVE-2022-21496 appeared first on CVE Vulnerability.

]]> CVE-2022-21443 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-21443/ Thu, 23 Feb 2023 05:02:33 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-21443/ Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle […]

The post CVE-2022-21443 appeared first on CVE Vulnerability.

]]> Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

The post CVE-2022-21443 appeared first on CVE Vulnerability.

]]> CVE-2022-1678 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-1678/ Thu, 23 Feb 2023 05:02:09 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-1678/ An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.

The post CVE-2022-1678 appeared first on CVE Vulnerability.

]]> An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients.

The post CVE-2022-1678 appeared first on CVE Vulnerability.

]]>