CVE Vulnerability Catalog

Arm Mbed TLS w wersjach przed 2.14.1, 2.7.8 i 2.1.17 umożliwia lokalnemu atakującemu bez uprawnień odzyskanie tekstu jawnego z odszyfrowania RSA, co dotyczy zestawów szyfrujących RSA bez (EC)DH(E).

cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service.

An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service.

An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

A NULL pointer dereference vulnerability has been found in the ncurses library, possibly version 6.x, in the function _nc_name_match, which can lead to a denial of service attack.

In ncurses 6.1, a null pointer dereference in the _nc_parse_entry function in parse_entry.c leads to a denial of service attack. The program proceeds to the dereference code path even after detecting a "dubious character `*' in name or alias field".

An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a, 1.1.0j, and 1.0.2q.

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Affected versions are 1.1.0-1.1.0i and 1.1.1. Fixed in OpenSSL 1.1.0j and 1.1.1a.

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.

The Linux kernel 4.14.67 mishandles certain interaction among XFRM Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, allowing local users to cause a denial of service (memory consumption and system hang) by leveraging root access to execute crafted applications.

A vulnerability in the TCP syslog module of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust 1550-byte buffers on an affected device, causing a DoS condition. The issue is due to a missing boundary check in an internal function. An attacker could exploit this by performing a man-in-the-middle attack between the device and its TCP syslog server and modifying TCP headers.

A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass an access control list (ACL) configured for an interface. The issue is due to errors that could occur when constructing and applying per-user-override rules. An attacker could connect to a network through an affected device, potentially accessing resources that would typically be protected by the interface ACL.

A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The issue occurs when the software fails to release spinlocks under low memory conditions, if FTP inspection and an access control rule with an FTP file policy are configured. An attacker could exploit this by sending high-rate transit traffic to cause a low-memory condition.

In Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90, when the default servlet returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo'), a specially crafted URL could be used to cause the redirect to be generated to any URI of the attacker's choice.

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

W produkcie PowerLogic firmy Schneider Electric (PM5560 przed wersją FW 2.5.4) występuje podatność na wstrzykiwanie między protokołami. Podatność ta umożliwia atak typu cross site scripting w przeglądarce internetowej urządzenia, co pozwala na manipulację danymi wejściowymi i wykonanie kodu JavaScript.