4 results (0.002 seconds)

CVSS: 5.0EPSS: 2%CPEs: 6EXPL: 0

CVE-2014-8483

https://notcve.org/view.php?id=CVE-2014-8483

The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string. La función blowfishECB en core/cipher.cpp en Quassel IRC 0.10.0 permite a atacantes remotos causar una denegación de servicio (lectura fuera de rango) a través de una cadena malformada. • http://bugs.quassel-irc.org/issues/1314 http://lists.opensuse.org/opensuse-updates/2014-11/msg00028.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00046.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html http://secunia.com/advisories/61932 http://secunia.com/advisories/62035 http://secunia.com/advisories/62261 http://www.debian.org/security/2014/dsa-3063 http://www.debian.org/security/2014/dsa-3068 http://www.ubuntu.com/usn/USN-2401-1 h • CWE-125: Out-of-bounds Read •

CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 1

CVE-2013-6404

https://notcve.org/view.php?id=CVE-2013-6404

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/. Quassel core (server daemon) en Quassel IRC anteriores a 0.9.2 no verifica correctamente el ID del usuario cuando accede a backlogs de usuario, lo cual permite a usuarios autenticados remotamente leer backlogs de otros usuarios a través del bufferid en (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, y (3) 16/select_buffer_by_id.sql en core/SQL/PostgreSQL/. • http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html http://osvdb.org/100432 http://quassel-irc.org/node/123 http://secunia.com/advisories/55640 http://www.openwall.com/lists/oss-security/2013/11/28/8 https://exchange.xforce.ibmcloud.com/vulnerabilities/89377 https://github.com/quassel/quassel/commit/a1a24da • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 5.0EPSS: 3%CPEs: 17EXPL: 0

CVE-2010-3443

https://notcve.org/view.php?id=CVE-2010-3443

ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message. ctcphandler.cpp en Quassel anterior a la versión 0.6.3 y 0.7.x anterior a 0.7.1 permite a atacantes remotos provocar una denegación de servicio (IRC sin respuesta) a través de múltiples peticiones Client-To-Client Protocol (CTCP) en un mensaje PRIVMSG. • http://bugs.quassel-irc.org/issues/1023 http://bugs.quassel-irc.org/issues/1024 http://git.quassel-irc.org/?p=quassel.git%3Ba=commitdiff%3Bh=a4ca568cdf68cf4a0343eb161518dc8e50cea87d http://quassel-irc.org/node/115 http://secunia.com/advisories/55581 http://security.gentoo.org/glsa/glsa-201311-03.xml http://ubuntu.com/usn/usn-991-1 • CWE-399: Resource Management Errors •

CVSS: 6.8EPSS: 0%CPEs: 130EXPL: 0

CVE-2013-4422

https://notcve.org/view.php?id=CVE-2013-4422

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message. Vulnerabilidad de inyección SQL en Quassel IRC anterior a la versión 0.9.1, cuando Qt 4.8.5 o posteriores y PostgreSQL 8.2 o posteriores son usados, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una \ (barra invertida) en un mensaje. • http://bugs.quassel-irc.org/issues/1244 http://quassel-irc.org/node/120 http://seclists.org/oss-sec/2013/q4/74 http://secunia.com/advisories/55194 http://secunia.com/advisories/55581 http://security.gentoo.org/glsa/glsa-201311-03.xml http://www.securityfocus.com/bid/62923 https://exchange.xforce.ibmcloud.com/vulnerabilities/87805 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •