CVE Vulnerability Catalog

Podatność CVE-2018-3639 dotyczy systemów z mikroprocesorami wykorzystującymi spekulacyjną egzekucję, które mogą ujawniać informacje osobom nieuprawnionym. Atakujący z lokalnym dostępem do systemu może wykorzystać analizę kanałów bocznych do uzyskania dostępu do danych, co jest znane jako Speculative Store Bypass (SSB), wariant 4.

The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as 'Content-Length: 1 2' to be interpreted as having a value of '12'. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for Content-Length. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.

A vulnerability in the detection engine of Cisco Firepower Threat Defense software could allow an unauthenticated, remote attacker to bypass a configured SSL Access Control (AC) policy to block SSL traffic. The issue is due to incorrect handling of TCP SSL packets received out of order. An attacker could send a crafted SSL connection through the device, bypassing the AC policy.

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action policies if Intelligent Application Bypass (IAB) with a drop percentage threshold is also configured. The issue is due to incorrect counting of dropped traffic percentage. An attacker could send network traffic to the device, bypassing policies and allowing traffic that should be dropped.

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the SMB protocol if a malware file is detected. The issue is due to how SMB handles a case where a large file transfer fails. An attacker could send a crafted SMB file transfer request through the device, allowing an SMB file containing malware to pass.

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy intended to drop SMB2 and SMB3 protocols if malware is detected. The issue is due to incorrect detection of SMB2/SMB3 files based on total file length. An attacker could exploit this by sending a crafted SMB2 or SMB3 transfer request through the targeted device.

The OpenSSL RSA key generation algorithm is vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Affected versions are 1.1.0-1.1.0h and 1.0.2b-1.0.2o.

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

A cross-site scripting (XSS) vulnerability was found in osTicket before version 1.10.2 in the /scp/index.php script. An attacker can inject arbitrary JavaScript or HTML code via the "sort" parameter.

An integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting.

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.