Most recent entries from all

bdu:2023-03437

Withdrawn: BELL-CVE-2020-28196 — CVE-2020-28196 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-296 — De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Certaines d'entre elles permettent à un attaquant de…

certfr-2021-avi-296

CLEANSTART-2024-LQ59066 — MIT Kerberos 5 (aka krb5) before 1

Affected: CleanStart: krb5

Security vulnerability affects the krb5 package. MIT Kerberos 5 (aka krb5) before 1.

EUVD-2026-262442

fkie_cve-2020-28196

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

GHSA-2wgw-3mv7-47xf

gsd-2020-28196

ICSA-23-348-10 — Siemens SIMATIC S7-1500

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

msrc_CVE-2020-28196 — MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerber…

msrc_CVE-2020-28196

OESA-2021-1026 — krb5 security update

Affected: openEuler:20.03-LTS: krb5, openEuler:20.03-LTS-SP1: krb5

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.\r\n\r\n Security Fix(es):\r\n\r\n MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.(CVE-2020-28196)\r\n\r\n

openSUSE-SU-2020:2037-1 — Security update for krb5

Security update for krb5

RHSA-2021:2239 — Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]

python-cryptography: Bleichenbacher timing oracle attack against RSA decryption krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow

SUSE-SU-2020:3375-1 — Security update for krb5

Security update for krb5

UBUNTU-CVE-2020-28196

Affected: Ubuntu:Pro:14.04:LTS: krb5, Ubuntu:16.04:LTS: krb5, Ubuntu:18.04:LTS: krb5, Ubuntu:20.04:LTS: krb5

WID-SEC-W-2022-0602 — IBM Security Verify Access: Mehrere Schwachstellen

Ein entfernter anonymer, authentisierter oder lokaler Angreifer oder ein Angreifer aus dem angrenzenden Netzwerk kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Informationen zu manipulieren, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.