Show filters
67 topics marked with the following tags:
Displaying 1-10 of 67
Sort by:
Attacker Value
Very Low

CVE-2009-2936

Disclosure Date: April 05, 2010 (last updated November 08, 2023)
The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.
0
Attacker Value
Very Low

CVE-2020-15466

Disclosure Date: July 05, 2020 (last updated November 08, 2023)
In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations.
Attacker Value
Low

CVE-2020-1241

Disclosure Date: June 09, 2020 (last updated October 06, 2023)
A security feature bypass vulnerability exists when Windows Kernel fails to properly sanitize certain parameters.To exploit the vulnerability, a locally-authenticated attacker could attempt to run a specially crafted application on a targeted system.The update addresses the vulnerability by correcting how Windows Kernel handles parameter sanitization., aka 'Windows Kernel Security Feature Bypass Vulnerability'.
Attacker Value
Very Low

CVE-2020-13668

Disclosure Date: February 11, 2022 (last updated October 07, 2023)
Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Attacker Value
Very Low

CVE-2020-14932

Disclosure Date: June 20, 2020 (last updated October 06, 2023)
compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.
Attacker Value
Very Low

TCP SACK PANIC

Last updated February 13, 2020
A Linux kernel vulnerability in TCP networking could allow DoS > CVE-2019-11477 is considered an Important severity, whereas CVE-2019-11478 and CVE-2019-11479 are considered a Moderate severity. The first two are related to the Selective Acknowledgement (SACK) packets combined with Maximum Segment Size (MSS), the third solely with the Maximum Segment Size (MSS). Vulnerable code exists in https://github.com/torvalds/linux/blob/master/include/linux/skbuff.h This might stick around in various embedded hardware, which could be more disasterous if DoS'ed, but it's too early to tell.
0
Attacker Value
Low

CVE-2022-21839

Disclosure Date: January 11, 2022 (last updated December 21, 2023)
Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
Attacker Value
Low

CVE-2023-41474

Disclosure Date: January 25, 2024 (last updated February 01, 2024)
Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component.
Attacker Value
Very Low

CVE-2023-2990

Disclosure Date: June 22, 2023 (last updated October 08, 2023)
Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service
Attacker Value
Very Low

CVE-2020-1296 Windows Diagnostics & feedback Information Disclosure Vulnerabili…

Disclosure Date: June 09, 2020 (last updated October 06, 2023)
A vulnerability exists in the way the Windows Diagnostics & feedback settings app handles objects in memory, aka 'Windows Diagnostics & feedback Information Disclosure Vulnerability'.