CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2020-25722
https://notcve.org/view.php?id=CVE-2020-25722
Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise. Se han encontrado múltiples fallos en la forma en que samba AD DC implementa el acceso y la comprobación de conformidad de los datos almacenados. Un atacante podría usar este fallo para causar un compromiso total del dominio • https://bugzilla.redhat.com/show_bug.cgi?id=2019764 https://security.gentoo.org/glsa/202309-06 https://www.samba.org/samba/security/CVE-2020-25722.html • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-23192 – samba: Subsequent DCE/RPC fragment injection vulnerability
https://notcve.org/view.php?id=CVE-2021-23192
A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements. Se ha encontrado un fallo en la forma en que samba implementa DCE/RPC. Si un cliente a un servidor Samba enviaba una petición DCE/RPC muy grande, y elegía fragmentarla, un atacante podía reemplazar los fragmentos posteriores con sus propios datos, omitiendo los requisitos de firma A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements. • https://bugzilla.redhat.com/show_bug.cgi?id=2019666 https://security.gentoo.org/glsa/202309-06 https://ubuntu.com/security/CVE-2021-23192 https://www.samba.org/samba/security/CVE-2021-23192.html https://access.redhat.com/security/cve/CVE-2021-23192 • CWE-20: Improper Input Validation •