CVSS: 9.8EPSS: 8%CPEs: 6EXPL: 0CVE-2021-44143
https://notcve.org/view.php?id=CVE-2021-44143
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution. Se ha encontrado un fallo en mbsync en isync versiones 1.4.0 hasta 1.4.3. Debido a una condición no comprobada, un servidor IMAP malicioso o comprometido podría usar un mensaje de correo diseñado que carece de encabezados (es decir, uno que comienza con una línea vacía) para provocar un desbordamiento de la pila, que podría ser explotado para una ejecución de código remota • http://www.openwall.com/lists/oss-security/2021/12/03/2 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYZ2GNB4ZO2T27D2XNUWMCS3THZYSJQU https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCBSY7OZ57XNC6ZYXF6WU5KBSWITZVDX https://security.gentoo.org/glsa/202208-15 https://sourceforge.net/p/isync/isync/commit_browser https://sourceforge.net/p/isync/isync/ref/master/ta • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-3935
https://notcve.org/view.php?id=CVE-2021-3935
When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1. Cuando PgBouncer está configurado para usar la autenticación "cert", un atacante de tipo "man-in-the-middle" puede inyectar consultas SQL arbitrarias cuando se establece una conexión por primera vez, a pesar del uso de la verificación y el cifrado de certificados TLS. Este fallo afecta a PgBouncer versiones anteriores a 1.16.1 • http://www.pgbouncer.org/changelog.html#pgbouncer-116x https://bugzilla.redhat.com/show_bug.cgi?id=2021251 https://lists.debian.org/debian-lts-announce/2022/02/msg00016.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPCV3KRDI5PLLLKADFVIOHACQJLZMLI • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-295: Improper Certificate Validation •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2021-40391
https://notcve.org/view.php?id=CVE-2021-40391
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Se presenta una vulnerabilidad de escritura fuera de límites en la funcionalidad drill format T-code tool number de Gerbv versión 2.7.0, dev (commit b5f1eacd), y la versión forked de Gerbv (commit 71493260). Un archivo de perforación especialmente diseñado puede conllevar a una ejecución de código. • https://lists.debian.org/debian-lts-announce/2021/12/msg00003.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUM5GIUZJ7AVHVCXDZW6ZVCAPV2ISN47 https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1402 • CWE-390: Detection of Error Condition Without Action CWE-755: Improper Handling of Exceptional Conditions CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-39923
https://notcve.org/view.php?id=CVE-2021-39923
Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file Un gran bucle en el disector PNRP en Wireshark versiones 3.4.0 a 3.4.9 y versiones 3.2.0 a 3.2.17 permite la denegación de servicio a través de la inyección de paquetes o un archivo de captura manipulado • https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39923.json https://gitlab.com/wireshark/wireshark/-/issues/17684 https://lists.debian.org/debian-lts-announce/2021/12/msg00015.html https://www.debian.org/security/2021/dsa-5019 https://www.wireshark.org/security/wnpa-sec-2021-11.html • CWE-834: Excessive Iteration •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 1CVE-2021-3973 – Heap-based Buffer Overflow in vim/vim
https://notcve.org/view.php?id=CVE-2021-3973
vim is vulnerable to Heap-based Buffer Overflow vim es vulnerable al desbordamiento del búfer en la región Heap de la memoria • http://www.openwall.com/lists/oss-security/2022/01/15/1 https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847 https://huntr.dev/bounties/ce6e8609-77c6-4e17-b9fc-a2e5abed052e https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL https://security.g • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •