CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-2056 – libtiff: division by zero issues in tiffcrop
https://notcve.org/view.php?id=CVE-2022-2056
30 Jun 2022 — Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Un error de División Por Cero en tiffcrop en libtiff versión 4.4.0, permite a atacantes causar una denegación de servicio por medio de un archivo tiff diseñado. Para usuarios que compilan libtiff a partir de las fuentes, la corrección está disponible con el commit f3a5e010 A divide-by-zero vulnerabilit... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2056.json • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-2057 – libtiff: division by zero issues in tiffcrop
https://notcve.org/view.php?id=CVE-2022-2057
30 Jun 2022 — Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Un error de División Por Cero en tiffcrop en libtiff versión 4.4.0 permite a atacantes causar una denegación de servicio por medio de un archivo tiff diseñado. Para usuarios que compilan libtiff a partir de las fuentes, la corrección está disponible con el commit f3a5e010 A divide-by-zero vulnerability... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2057.json • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-2058 – libtiff: division by zero issues in tiffcrop
https://notcve.org/view.php?id=CVE-2022-2058
30 Jun 2022 — Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Un error de División Por Cero en tiffcrop en libtiff versión 4.4.0, permite a atacantes causar una denegación de servicio por medio de un archivo tiff diseñado. Para usuarios que compilan libtiff a partir de las fuentes, la corrección está disponible con el commit f3a5e010 A divide-by-zero vulnerabilit... • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2058.json • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 2%CPEs: 33EXPL: 2CVE-2022-32206 – curl: HTTP compression denial of service
https://notcve.org/view.php?id=CVE-2022-32206
28 Jun 2022 — curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memo... • https://github.com/HimanshuS67/external_curl_AOSP10_CVE-2022-32206 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 1CVE-2022-32208 – curl: FTP-KRB bad message verification
https://notcve.org/view.php?id=CVE-2022-32208
28 Jun 2022 — When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Cuando curl versiones anteriores a 7.84.0, hace transferencias FTP aseguradas por krb5, maneja inapropiadamente los fallos de verificación de mensajes. Este fallo hace posible que un ataque de tipo Man-In-The-Middle pase desapercibido e incluso permite inyectar datos al cliente A vu... • http://seclists.org/fulldisclosure/2022/Oct/28 • CWE-787: Out-of-bounds Write CWE-840: Business Logic Errors CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 1CVE-2022-31081 – Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon
https://notcve.org/view.php?id=CVE-2022-31081
27 Jun 2022 — HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. • http://metacpan.org/release/HTTP-Daemon • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 6.1EPSS: 5%CPEs: 4EXPL: 1CVE-2022-32209 – rubygem-rails-html-sanitizer: possible xss with certain configurations
https://notcve.org/view.php?id=CVE-2022-32209
24 Jun 2022 — # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `... • https://hackerone.com/reports/1530898 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 8%CPEs: 6EXPL: 0CVE-2021-46784 – squid: DoS when processing gopher server responses
https://notcve.org/view.php?id=CVE-2021-46784
23 Jun 2022 — In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. En Squid versiones 3.x hasta 3.5.28, versiones 4.x hasta 4.17 y versiones 5.x anteriores a 5.6, debido a una administración inapropiada del búfer, puede producirse una denegación de servicio cuando son procesadas respuestas largas del servidor Gopher A vulnerability was found in squid (Web proxy cache server). This issue occurs due ... • http://www.openwall.com/lists/oss-security/2023/10/13/1 • CWE-617: Reachable Assertion •
CVSS: 10.0EPSS: 71%CPEs: 50EXPL: 1CVE-2022-2068 – The c_rehash script allows command injection
https://notcve.org/view.php?id=CVE-2022-2068
21 Jun 2022 — In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where... • https://packetstorm.news/files/id/182466 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2022-2129 – Out-of-bounds Write in vim/vim
https://notcve.org/view.php?id=CVE-2022-2129
19 Jun 2022 — Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Una Escritura fuera de Límites en el repositorio de GitHub vim/vim versiones anteriores a 8.2 It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. • https://github.com/vim/vim/commit/d6211a52ab9f53b82f884561ed43d2fe4d24ff7d • CWE-787: Out-of-bounds Write •