extra_packages_for_enterprise_linux Archives - CVE Vulnerability

CVE-2020-9274

Sun, 26 Feb 2023 06:43:41 +0000

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.

The post CVE-2020-9274 appeared first on CVE Vulnerability.

CVE-2020-14394

Sun, 26 Feb 2023 06:37:18 +0000

An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.

The post CVE-2020-14394 appeared first on CVE Vulnerability.

CVE-2021-3733

Thu, 23 Feb 2023 14:10:54 +0000

There’s a flaw in urllib’s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

The post CVE-2021-3733 appeared first on CVE Vulnerability.

CVE-2021-21897

Thu, 23 Feb 2023 14:07:08 +0000

A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

The post CVE-2021-21897 appeared first on CVE Vulnerability.

CVE-2021-20247

Thu, 23 Feb 2023 14:06:42 +0000

A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing ‘..’ path components to access data outside the designated mailbox on the opposite end of the synchronization channel. The highest threat from this vulnerability is to data confidentiality and integrity.

The post CVE-2021-20247 appeared first on CVE Vulnerability.

CVE-2022-45152

godfreyd94 — Thu, 23 Feb 2023 05:21:24 +0000

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle’s inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.

The post CVE-2022-45152 appeared first on CVE Vulnerability.

CVE-2022-4170

godfreyd94 — Thu, 23 Feb 2023 05:20:50 +0000

The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user’s terminal and certain options are set.

The post CVE-2022-4170 appeared first on CVE Vulnerability.

CVE-2022-40316

godfreyd94 — Thu, 23 Feb 2023 05:20:34 +0000

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

The post CVE-2022-40316 appeared first on CVE Vulnerability.

CVE-2022-40313

godfreyd94 — Thu, 23 Feb 2023 05:20:34 +0000

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.

The post CVE-2022-40313 appeared first on CVE Vulnerability.

CVE-2022-28327

godfreyd94 — Thu, 23 Feb 2023 05:18:14 +0000

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

The post CVE-2022-28327 appeared first on CVE Vulnerability.