3 results (0.013 seconds)

CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 1

CVE-2013-6404

https://notcve.org/view.php?id=CVE-2013-6404

Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/. Quassel core (server daemon) en Quassel IRC anteriores a 0.9.2 no verifica correctamente el ID del usuario cuando accede a backlogs de usuario, lo cual permite a usuarios autenticados remotamente leer backlogs de otros usuarios a través del bufferid en (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, y (3) 16/select_buffer_by_id.sql en core/SQL/PostgreSQL/. • http://lists.opensuse.org/opensuse-updates/2013-12/msg00092.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00078.html http://osvdb.org/100432 http://quassel-irc.org/node/123 http://secunia.com/advisories/55640 http://www.openwall.com/lists/oss-security/2013/11/28/8 https://exchange.xforce.ibmcloud.com/vulnerabilities/89377 https://github.com/quassel/quassel/commit/a1a24da • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 5.0EPSS: 3%CPEs: 17EXPL: 0

CVE-2010-3443

https://notcve.org/view.php?id=CVE-2010-3443

ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message. ctcphandler.cpp en Quassel anterior a la versión 0.6.3 y 0.7.x anterior a 0.7.1 permite a atacantes remotos provocar una denegación de servicio (IRC sin respuesta) a través de múltiples peticiones Client-To-Client Protocol (CTCP) en un mensaje PRIVMSG. • http://bugs.quassel-irc.org/issues/1023 http://bugs.quassel-irc.org/issues/1024 http://git.quassel-irc.org/?p=quassel.git%3Ba=commitdiff%3Bh=a4ca568cdf68cf4a0343eb161518dc8e50cea87d http://quassel-irc.org/node/115 http://secunia.com/advisories/55581 http://security.gentoo.org/glsa/glsa-201311-03.xml http://ubuntu.com/usn/usn-991-1 • CWE-399: Resource Management Errors •

CVSS: 6.8EPSS: 0%CPEs: 130EXPL: 0

CVE-2013-4422

https://notcve.org/view.php?id=CVE-2013-4422

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message. Vulnerabilidad de inyección SQL en Quassel IRC anterior a la versión 0.9.1, cuando Qt 4.8.5 o posteriores y PostgreSQL 8.2 o posteriores son usados, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una \ (barra invertida) en un mensaje. • http://bugs.quassel-irc.org/issues/1244 http://quassel-irc.org/node/120 http://seclists.org/oss-sec/2013/q4/74 http://secunia.com/advisories/55194 http://secunia.com/advisories/55581 http://security.gentoo.org/glsa/glsa-201311-03.xml http://www.securityfocus.com/bid/62923 https://exchange.xforce.ibmcloud.com/vulnerabilities/87805 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •