CVE Vulnerability Catalog

OpenSSH, przy użyciu OPIE (Jednorazowe Hasła w Wszystkim) dla PAM, umożliwia zdalnym atakującym ustalenie istnienia określonych kont użytkowników. Odpowiedź jest różna w zależności od tego, czy konto użytkownika istnieje i jest skonfigurowane do używania jednorazowych haseł (OTP).

W skrypcie readline.sh w socat przed wersją 1.8.0.2 występuje zależność od pliku /tmp/$USER/stderr2. Może to prowadzić do nieautoryzowanego dostępu do danych użytkownika.

Sudo w wersjach przed 1.9.15 może być podatne na ataki typu row hammer, które mogą prowadzić do obejścia uwierzytelnienia lub eskalacji uprawnień. Problem wynika z logiki aplikacji, która opiera się na braku równości z wartością błędu, zamiast na równości z wartością sukcesu.

W tcpdump w wersji 4.9.2 występuje błąd przepełnienia bufora na stosie w funkcji print_prefix w pliku print-hncp.c, spowodowany brakiem inicjalizacji, co może prowadzić do odczytu nieprzeznaczonych danych z pamięci.

The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.

When parsing a multipart form in Go, limits on the total form size were not applied to memory consumed while reading a single form line. This allows an attacker to send a malicious request causing excessive memory consumption.

The html/template package in Go improperly applies rules for handling "<script", "<!--", and "</script" sequences within JS literals in <script> contexts. This may cause the template parser to prematurely terminate script contexts, leading to improper escaping of actions.

The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.

A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause excessive memory and CPU consumption while parsing YAML, as used by Docker Compose from versions v2.27.0 to v2.29.7.

A race condition in the Go database/sql package can overwrite expected results when a query is cancelled during the Scan method call while other queries run in parallel.

The RedirectSlashes function in middleware/strip.go is vulnerable to host header injection leading to an open redirect. This is considered lower-severity as it cannot be exploited from browsers or email clients.

A vulnerability in cross-origin redirect handling causes Proxy-Authorization and Proxy-Authenticate headers to persist, potentially leaking sensitive authentication data.

A vulnerability in the assembly implementation of an internal cryptographic function on the ppc64le architecture leaks a few bits of secret scalars due to the use of a variable-time instruction. Based on how this function is used, the leakage is not sufficient to recover the private key.

A vulnerability in the os package of the Go standard library allows improper access to the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") opens the parent directory, bypassing access restrictions.

The Go HTTP client drops sensitive headers (e.g., Authorization) after a cross-domain redirect, but may re-send them on a subsequent same-domain redirect, posing a potential data leak risk.

A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.

A vulnerability in the Go standard parser causes a panic when processing source code with deeply nested literals. The issue stems from stack exhaustion during recursive parsing.

A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.

A vulnerability in the Go standard library (net/http) causes the HTTP client to not forward sensitive headers like Authorization or Cookie when following a redirect to a domain that is not a subdomain or exact match of the original domain. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to a different domain will not.