CVSS: 7.8EPSS: 85%CPEs: 9EXPL: 8CVE-2022-3602 – X.509 Email Address 4-byte Buffer Overflow
https://notcve.org/view.php?id=CVE-2022-3602
01 Nov 2022 — A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash... • https://github.com/colmmacc/CVE-2022-3602 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-3421 – rpm: unsigned signature header leads to string injection into an rpm database
https://notcve.org/view.php?id=CVE-2021-3421
19 May 2021 — A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha. Se encontró un fallo en el paquete RPM en la funcionalidad read. • https://bugzilla.redhat.com/show_bug.cgi?id=1927747 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2021-3531 – ceph: RGW unauthenticated denial of service
https://notcve.org/view.php?id=CVE-2021-3531
18 May 2021 — A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. The greatest threat to the system is of availability. Se encontró un fallo en Red Hat Ceph Storage RGW en versiones anteriores a 14.2.21. Cuando se procesa una petición GET para una URL rápida que termina con dos barras, puede hacer que rgw pueda bloquearse, resultando en una denegación de s... • http://www.openwall.com/lists/oss-security/2021/05/14/5 • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-3524 – gateway: radosgw: CRLF injection
https://notcve.org/view.php?id=CVE-2021-3524
17 May 2021 — A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created. Se encontró un fallo en ... • https://bugzilla.redhat.com/show_bug.cgi?id=1951674 • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.9EPSS: 3%CPEs: 6EXPL: 0CVE-2021-32921 – Debian Security Advisory 4916-1
https://notcve.org/view.php?id=CVE-2021-32921
13 May 2021 — An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker. Se detectó un problema en Prosody versiones anteriores a 0.11.9. No utiliza un algoritmo de tiempo constante para comparar determinadas cadenas secretas cuando se ejecuta bajo Lua versiones 5.2 o posteriores. • http://www.openwall.com/lists/oss-security/2021/05/13/1 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 3%CPEs: 5EXPL: 0CVE-2021-32920 – Debian Security Advisory 4916-1
https://notcve.org/view.php?id=CVE-2021-32920
13 May 2021 — Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. Prosody versiones anteriores a 0.11.9, permite un Consumo No Controlado de CPU por medio de una avalancha de peticiones de renegociación SSL/TLS Multiple vulnerabilities have been found in Prosŏdy IM, the worst of which could result in a Denial of Service condition. Versions less than 0.11.9 are affected. • http://www.openwall.com/lists/oss-security/2021/05/13/1 •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-32919 – Debian Security Advisory 4916-1
https://notcve.org/view.php?id=CVE-2021-32919
13 May 2021 — An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enables an experimental feature for server-to-server authentication. It does not correctly authenticate remote server certificates, allowing a remote server to impersonate another server (when this option is enabled). Se detectó un problema en Prosody versiones anteriores a 0.11.9. La opción no documentada dialback_without_dialback en la función mod_dialback habilita una funcionalidad exp... • http://www.openwall.com/lists/oss-security/2021/05/13/1 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 2%CPEs: 7EXPL: 0CVE-2021-32918 – Debian Security Advisory 4916-1
https://notcve.org/view.php?id=CVE-2021-32918
13 May 2021 — An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3. Se detectó un problema en Prosody versiones anteriores a 0.11.9. La configuración predeterminada es susceptible a ataques remotos de denegación de servicio (DoS) no autenticados por medio del agotamiento de la memoria cuando se ejecuta bajo Lua versiones 5.2 o Lua 5.3 Multiple vulnerabilities have been f... • http://www.openwall.com/lists/oss-security/2021/05/13/1 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 5%CPEs: 6EXPL: 0CVE-2021-32917 – Debian Security Advisory 4916-1
https://notcve.org/view.php?id=CVE-2021-32917
13 May 2021 — An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth. Se detectó un problema en Prosody versiones anteriores a 0.11.9. El componente proxy65 permite un acceso abierto por defecto, incluso si ninguno de los usuarios tiene una cuenta XMPP en el servidor local, permitiendo el uso sin restricciones del ancho de banda del servidor Multipl... • http://www.openwall.com/lists/oss-security/2021/05/13/1 • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-25713 – raptor2: malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common
https://notcve.org/view.php?id=CVE-2020-25713
13 May 2021 — A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common. Un archivo de entrada malformado puede conllevar a un error de segmentación debido a un acceso a la matriz fuera de límites en la función raptor_xml_writer_start_element_common It was discovered that Raptor incorrectly handled memory operations when processing certain input files. A remote attacker could possibly use this issue to cause Raptor to crash, resulting in a denial of servi... • http://www.openwall.com/lists/oss-security/2020/11/16/1 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •