Threat database

Deskflow versions prior to 1.26.0.167 have a remote, unauthenticated denial of service (DoS) vulnerability affecting servers running with TLS enabled. Malformed TCP connections that do not initiate a valid TLS handshake cause the server's main worker thread to sleep for one second, blocking input delivery to all connected clients. Sustained malformed connection attempts can render the server unusable. This issue is fixed in version 1.26.0.167.

In uriparser versions before 1.0.2, the EqualsUri function family can incorrectly determine that two different URIs are equal. This misclassification may lead to incorrect URI comparisons.

ProFTPD versions through 1.3.9a before commit 7666224 contain a SQL injection vulnerability in the sqltab_fetch_clients_cb() function within contrib/mod_wrap2_sql.c. This flaw allows remote attackers to inject arbitrary SQL commands via a crafted domain name used in reverse DNS lookups when the UseReverseDNS option is enabled. The vulnerability arises because the attacker-controlled hostname is passed unescaped into SQL queries. DNS naming restrictions may limit exploitability.

OpenStack Horizon versions 25.6 and 25.7 prior to 25.7.3 contain a vulnerability where unauthenticated requests can perform write operations to the session storage backend, potentially exhausting storage resources. This issue is a regression of a previous fix (CVE-2014-8124). The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or integrity but can affect availability.

Apache Thrift versions before 0.23.0 contain an improper validation of certificates with host mismatch vulnerability. This flaw can lead to confidentiality, integrity, and availability impacts. The issue is resolved in version 0.23.0, which users are advised to upgrade to.

A directory traversal vulnerability in Nix before version 2.34.7 allows writing to arbitrary files via the 'nix-prefetch-url --unpack' or 'nix store prefetch-file --unpack' commands. This issue affects multiple versions starting from 2.24.7 up to but not including 2.34.7. The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or availability but can lead to integrity loss. Fixed versions include 2.34.7 and several earlier patch releases.

A vulnerability in mutt before version 2.3.2 causes the hash_passwd to sometimes be truncated by one byte during IMAP auth_cram MD5 digest processing. This issue can lead to integrity problems in authentication. The CVSS score is 3.7, indicating a medium severity level.

A vulnerability exists in mutt versions before 2.3.2 where the function url_pct_decode does not properly check for null ('\0') characters. This issue has a CVSS 3.7 score and is rated medium severity. It may lead to limited impact on integrity but does not affect confidentiality or availability. Multiple specific mutt package versions are affected. No known exploits are reported in the wild. No patch or remediation details are provided in the source data.

A vulnerability in mutt before version 2.3.2 involves mishandling of the imap_auth_gss security level. This issue has a medium severity rating with a CVSS score of 3.7. It affects multiple specific versions of mutt, including various Ubuntu package versions. No known exploits are reported in the wild.

Mutt versions before 2.3.2 contain an infinite loop vulnerability in the data_object_to_stream function within crypt-gpgme.c. This flaw can cause the application to hang or become unresponsive. The vulnerability has a medium severity rating with a CVSS score of 3.7.

A NULL pointer dereference vulnerability exists in mutt before version 2.3.2 in the show_sig_summary function. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity rating with a CVSS score of 2.5.

A vulnerability in Prosody versions before 0.12.6 and from 1.0.0 through 13.0.0 before 13.0.5 affects the mod_proxy65 module. The module mishandles access control when paused, allowing unauthenticated traffic to be relayed. This issue has a medium severity rating with a CVSS score of 6.5.

A vulnerability exists in Prosody versions before 0.12.6 and from 1.0.0 through 13.0.0 before 13.0.5 when the mod_proxy65 module is enabled. The issue involves improper access control handling in mod_proxy65 during activation, which can allow unauthenticated traffic to be relayed. This vulnerability has a medium severity with a CVSS score of 6.5.

A denial of service vulnerability exists in Prosody versions before 0.12.6 and from 1.0.0 through 13.0.0 before 13.0.5. The issue is caused by memory exhaustion due to memory leaks triggered by unauthenticated connections.

A denial of service vulnerability exists in Prosody versions before 0.12.6 and from 1.0.0 through 13.0.0 before 13.0.5. The issue is caused by memory exhaustion due to XML parsing resource amplification from unauthenticated connections.

OpenStack ironic-python-agent versions 1.0.0 through 11.5.0 contain a vulnerability where the agent sometimes executes grub-install from within a chroot of the deployed partition image. This behavior can lead to code execution if the deployed image is malicious. The vulnerability has a CVSS score of 8.5, indicating high impact on confidentiality, integrity, and availability.