CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20236
https://notcve.org/view.php?id=CVE-2021-20236
A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se encontró un fallo en el servidor ZeroMQ en versiones anteriores a 4.3.3. Este fallo permite a un cliente malicioso causar un desbordamiento del búfer de pila en el servidor mediante el envío de peticiones de suscripción de temas diseñadas y luego cancelando la suscripción. • https://bugzilla.redhat.com/show_bug.cgi?id=1921976 https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-9721
https://notcve.org/view.php?id=CVE-2014-9721
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header. ibzmq en versiones anteriores a 4.0.6 y 4.1.x en versiones anteriores a 4.1.1 permite a atacantes remotos llevar a cabo ataques de degradado y eludir mecanismos de protocolos de seguridad ZMTP v3 a través de una cabecera ZMTP v2 o versiones anteriores. • http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html http://lists.opensuse.org/opensuse-updates/2015-06/msg00018.html http://www.debian.org/security/2015/dsa-3255 https://github.com/zeromq/libzmq/issues/1273 https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2014-7203
https://notcve.org/view.php?id=CVE-2014-7203
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors. libzmq (también conocido como ZeroMQ/C++) 4.0.x anterior a 4.0.5 no asegura que los caracteres de un solo uso sean únicos, lo que permite a atacantes man-in-the-middle realizar ataques de reproducción a través de vectores no especificados. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html http://seclists.org/oss-sec/2014/q3/754 http://seclists.org/oss-sec/2014/q3/776 http://secunia.com/advisories/62262 http://www.securityfocus.com/bid/70157 https://exchange.xforce.ibmcloud.com/vulnerabilities/96242 https://github.com/zeromq/libzmq/issues/1191 https://github.com/zeromq/libzmq/pull/1189 •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-7202
https://notcve.org/view.php?id=CVE-2014-7202
stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request. stream_engine.cpp en libzmq (también conocido como ZeroMQ/C++)) 4.0.5 anterior a 4.0.5 permite a atacantes man-in-the-middle realizar ataques de degradación a través de una solicitud de conexión manipulada. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00027.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00101.html http://seclists.org/oss-sec/2014/q3/754 http://seclists.org/oss-sec/2014/q3/776 http://secunia.com/advisories/62262 http://www.securityfocus.com/bid/70157 https://exchange.xforce.ibmcloud.com/vulnerabilities/96241 https://github.com/zeromq/libzmq/issues/1190 https://github.com/zeromq/libzmq/pull/1188 •