update by case project update by case vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

A path traversal vulnerability exists in go-git versions prior to v5.11. This vulnerability allows an malicious user to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are us...

Go-git Project Go-git

1 Github repository

5.3

CVSSv3

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of d...

Golang Go

NA

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

70 Github repositories

3.3

CVSSv3

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Libcap Project Libcap 2.66 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 6.0 Redhat Enterprise Linux 8.0 Redhat Enterprise Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0 Debian Debian Linux 12.0 Fedoraproject Fedora 37 Fedoraproject Fedora 38

1 Github repository

7.5

CVSSv3

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 lengt...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38 Debian Debian Linux 10.0 Debian Debian Linux 11.0

3.7

CVSSv3

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an malicious user to ...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38

6.4

CVSSv3

c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would r...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38 Debian Debian Linux 10.0 Debian Debian Linux 11.0

6.5

CVSSv3

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the ra...

C-ares Project C-ares Fedoraproject Fedora 37 Fedoraproject Fedora 38

6.5

CVSSv3

In libxml2 prior to 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Xmlsoft Libxml2 Debian Debian Linux 10.0

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook