Most recent entries from all

bdu:2026-12815

Withdrawn: BELL-CVE-2018-20679 — CVE-2018-20679 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0199

EUVD-2026-243478

fkie_cve-2018-20679

An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.

GHSA-73q8-6p6h-wvfh

gsd-2018-20679

ICSA-21-054-03 — Advantech Spectre RT Industrial Routers

The affected product does not neutralize special characters in the error response, allowing attackers to use a reflected XSS attack.CVE-2019-18233 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Login and password are transmitted in clear text form, which may allow an attacker to intercept the request.CVE-2019-18231 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Insufficient login authentication parameters required for the web application may allow an attacker to gain full access using a brute-force password attack.CVE-2019-18235 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Outdated version of BusyBox password encryption is in use, which may allow an attacker to discover passwords.CVE-2018-20679, CVE-2016-6301, CVE-2015-9261, and others have been assigned to this version of BusyBox. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Outdated version of OpenSSL is in use, which may allow an attacker to exploit known vulnerabilities in OpenSSL.CVE-2016-2842, CVE-2016-0799, CVE-2016-6304 and others have been assigned to this version of OpenSSL. A CVSS v3 base score of 10.0 has been calculated; the…

openSUSE-SU-2021:1408-1 — Security update for busybox

Security update for busybox

SUSE-SU-2021:3531-1 — Security update for busybox

Security update for busybox

UBUNTU-CVE-2018-20679

Affected: Ubuntu:14.04:LTS: busybox, Ubuntu:16.04:LTS: busybox, Ubuntu:18.04:LTS: busybox

VDE-2020-038 — Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface. Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection. An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes. During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o). Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd