Most recent entries from all

bdu:2024-04210

Withdrawn: BELL-CVE-2023-0809 — CVE-2023-0809 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2024-avi-0297 — De multiples vulnérabilités ont été découvertes dans Juniper. Certaines d'entre elles permettent à un attaquant de prov…

certfr-2024-avi-0297

EUVD-2026-216136

fkie_cve-2023-0809

In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.

GHSA-v9xr-r3xx-x9gc

In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.

gsd-2023-0809

OESA-2023-1716 — mosquitto security update

Affected: openEuler:22.03-LTS-SP1: mosquitto

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. Security Fix(es): In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.(CVE-2023-0809)

openSUSE-SU-2024:13546-1 — libmosquitto1-2.0.18-1.1 on GA media

libmosquitto1-2.0.18-1.1 on GA media

RHSA-2024:0797 — Red Hat Security Advisory: Satellite 6.14.2 Async Security Update

mosquitto: memory leak leads to unresponsive broker mosquitto: memory leak leads to unresponsive broker gRPC: file descriptor exhaustion leads to denial of service jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies sidekiq: DoS in dashboard-charts mosquitto: memory leak leads to unresponsive broker jetty: Improper addition of quotation marks to user inputs in CgiServlet curl: heap based buffer overflow in the SOCKS5 proxy handshake jetty: Improper validation of HTTP/1 content-length rubygem-puma: HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers

SCA-2025-0006 — Vulnerability affecting picoScan and multiScan

The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type attack, causing the web page to become unresponsive. Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege. Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege. SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally all…

UBUNTU-CVE-2023-0809

Affected: Ubuntu:Pro:20.04:LTS: mosquitto, Ubuntu:22.04:LTS: mosquitto

In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.

WID-SEC-W-2023-2724 — IBM Integration Bus: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Integration Bus ausnutzen, um einen Denial of Service Angriff durchzuführen.