CWE-1389 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1389/ Sun, 26 Feb 2023 06:37:04 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-1389 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1389/ 32 32 CVE-2020-13776 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-13776/ Sun, 26 Feb 2023 06:37:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-13776/ systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

The post CVE-2020-13776 appeared first on CVE Vulnerability.

]]> systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

The post CVE-2020-13776 appeared first on CVE Vulnerability.

]]> CVE-2021-29921 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-29921/ Thu, 23 Feb 2023 14:09:08 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-29921/ In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

The post CVE-2021-29921 appeared first on CVE Vulnerability.

]]> In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

The post CVE-2021-29921 appeared first on CVE Vulnerability.

]]> CVE-2021-29923 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-29923/ Thu, 23 Feb 2023 14:09:08 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-29923/ Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

The post CVE-2021-29923 appeared first on CVE Vulnerability.

]]> Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

The post CVE-2021-29923 appeared first on CVE Vulnerability.

]]> CVE-2021-29662 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-29662/ Thu, 23 Feb 2023 14:09:03 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-29662/ The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

The post CVE-2021-29662 appeared first on CVE Vulnerability.

]]> The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

The post CVE-2021-29662 appeared first on CVE Vulnerability.

]]> CVE-2021-29424 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-29424/ Thu, 23 Feb 2023 14:08:59 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-29424/ The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

The post CVE-2021-29424 appeared first on CVE Vulnerability.

]]> The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.

The post CVE-2021-29424 appeared first on CVE Vulnerability.

]]> CVE-2021-28918 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-28918/ Thu, 23 Feb 2023 14:08:53 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-28918/ Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

The post CVE-2021-28918 appeared first on CVE Vulnerability.

]]> Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

The post CVE-2021-28918 appeared first on CVE Vulnerability.

]]>