CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-2819 – Heap-based Buffer Overflow in vim/vim
https://notcve.org/view.php?id=CVE-2022-2819
15 Aug 2022 — Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. Un Desbordamiento de búfer en la Región Heap de la Memoria en el repositorio de GitHub vim/vim versiones anteriores a 9.0.0211. It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. • https://github.com/vim/vim/commit/d1d8f6bacb489036d0fd479c9dd3c0102c988889 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-38150
https://notcve.org/view.php?id=CVE-2022-38150
11 Aug 2022 — In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1. En Varnish Cache versiones 7.0.0, 7.0.1, 7.0.2 y 7.1.0, es posible causar que el servidor Varnish sea afirmado y reiniciado automáticamente mediante respuestas backend HTTP/1 falsificadas. Un ataque usa una frase de razón diseñada de... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-31779 – Improper HTTP/2 scheme and method validation
https://notcve.org/view.php?id=CVE-2022-31779
10 Aug 2022 — Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en el análisis de encabezados de HTTP/2 de Apache Traffic Server permite a un atacante contrabandear peticiones. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 9.1.2 Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forwa... • https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-25763 – Improper input validation on HTTP/2 headers
https://notcve.org/view.php?id=CVE-2022-25763
10 Aug 2022 — Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en la comprobación de peticiones HTTP/2 de Apache Traffic Server permite a un atacante crear ataques de contrabando o envenenamiento de caché. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 9.1.2 Several vulnerabilities were ... • https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-28129 – Insufficient Validation of HTTP/1.x Headers
https://notcve.org/view.php?id=CVE-2022-28129
10 Aug 2022 — Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en el análisis del encabezado HTTP/1.1 de Apache Traffic Server permite a un atacante enviar encabezados no válidos. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 9.1.2 Several vulnerabilities were discovered in Apache Traffic Server, a reverse... • https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-37150 – Protocol vs scheme mismatch
https://notcve.org/view.php?id=CVE-2021-37150
10 Aug 2022 — Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en el análisis de encabezados de Apache Traffic Server permite a un atacante solicitar recursos seguros. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 9.1.2 Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward prox... • https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-31780 – HTTP/2 framing vulnerabilities
https://notcve.org/view.php?id=CVE-2022-31780
10 Aug 2022 — Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Una vulnerabilidad de Comprobación de Entrada Inapropiada en el manejo de tramas HTTP/2 de Apache Traffic Server permite a un atacante contrabandear peticiones. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 9.1.2 Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy s... • https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 • CWE-20: Improper Input Validation •
CVSS: 9.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-33643 – libtar: out-of-bounds read in gnu_longlink
https://notcve.org/view.php?id=CVE-2021-33643
09 Aug 2022 — An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. Un atacante que envía un archivo tar diseñado con el tamaño de la estructura de encabezado siendo 0 puede ser capaz de desencadenar una llamada de malloc(0) para una variable gnu_longlink, causando una lectura fuera de límites A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with the siz... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC • CWE-125: Out-of-bounds Read •
CVSS: 9.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-33644 – libtar: out-of-bounds read in gnu_longname
https://notcve.org/view.php?id=CVE-2021-33644
09 Aug 2022 — An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. Un atacante que envía un archivo tar diseñado con el tamaño de la estructura de cabecera siendo 0 puede ser capaz de desencadenar una llamada de malloc(0) para una variable gnu_longname, causando una lectura fuera de límites A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with size in h... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-33645 – libtar: memory leak found in th_read() function
https://notcve.org/view.php?id=CVE-2021-33645
09 Aug 2022 — The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak. La función th_read() no libera una variable t-)th_buf.gnu_longlink después de asignar memoria, lo que puede causar una pérdida de memoria A flaw was found in libtar. This security vulnerability occurs because the th_read() function in libtar doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak. The libtar packages contain a C library f... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC • CWE-401: Missing Release of Memory after Effective Lifetime •