CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42390
https://notcve.org/view.php?id=CVE-2021-42390
14 Mar 2022 — Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. Una división por cero en el códec de compresión DeltaDouble de Clickhouse cuando es analizada una consulta maliciosa. El primer byte del búfer comprimido es usado en una operación de módulo sin que sea comprobado el 0 • https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42389
https://notcve.org/view.php?id=CVE-2021-42389
14 Mar 2022 — Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. Una división por cero en el códec de compresión Delta de Clickhouse cuando es analizada una consulta maliciosa. El primer byte del búfer comprimido es usado en una operación de módulo sin que sea comprobado el 0 • https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms • CWE-369: Divide By Zero •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42387 – Ubuntu Security Notice USN-6933-1
https://notcve.org/view.php?id=CVE-2021-42387
14 Mar 2022 — Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation. Una lectura fuera de límites de la pila en el códec de compresión LZ4 de Clickhouse cuando es analizada una consulta maliciosa. Como parte del bucle LZ4::decompr... • https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-42388
https://notcve.org/view.php?id=CVE-2021-42388
14 Mar 2022 — Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation. Una lectura fuera de límites de la pila en el códec de compresión LZ4 de Clickhouse cuando es analizada una consulta maliciosa. Como parte del bucle LZ4::decompr... • https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-43304
https://notcve.org/view.php?id=CVE-2021-43304
14 Mar 2022 — Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-43305
https://notcve.org/view.php?id=CVE-2021-43305
14 Mar 2022 — Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrary copy operation wildCopy
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27970
https://notcve.org/view.php?id=CVE-2020-27970
13 Sep 2021 — Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar Yandex Browser versiones anteriores a 20.10.0, permite a atacantes remotos falsificar la barra de direcciones • https://yandex.com/bugbounty/i/hall-of-fame-browser • CWE-290: Authentication Bypass by Spoofing •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-27969
https://notcve.org/view.php?id=CVE-2020-27969
13 Sep 2021 — Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing Yandex Browser para Android versión 20.8.4, permite a atacantes remotos llevar a cabo una omisión del SOP y una suplantación de la barra de direcciones • https://yandex.com/bugbounty/i/hall-of-fame-browser • CWE-346: Origin Validation Error •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25263
https://notcve.org/view.php?id=CVE-2021-25263
17 Aug 2021 — Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating files in directory with insecure permissions during Yandex Browser update process. La vulnerabilidad de privilegios locales en Yandex Browser para Windows anterior a la versión 21.9.0.390 permite a un atacante local, con pocos privilegios, ejecutar código arbitrario con los privilegios del SISTEMA a través de la mani... • https://yandex.com/bugbounty/i/hall-of-fame-browser • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24428 – RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS
https://notcve.org/view.php?id=CVE-2021-24428
23 Apr 2021 — The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed. El plugin RSS para Yandex Turbo WordPress versiones hasta 1.30, no sanea o escapa de algunas de sus configuraciones antes de guardarlas y mostrarlas en el panel de administración, conllevando a un problema de tipo Cross-Site Scriptin... • https://m0ze.ru/vulnerability/%5B2021-04-23%5D-%5BWordPress%5D-%5BCWE-79%5D-RSS-for-Yandex-Turbo-WordPress-Plugin-v1.30.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •