qualys security advisory vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c).

Openbsd Openbsd 6.6

1 Github repository

7.8

CVSSv3

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c.

Openbsd Openbsd 6.6

7.8

CVSSv3

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen.

Openbsd Openbsd 6.6

1 Github repository

7.8

CVSSv3

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned b...

Openbsd Openbsd 6.6

1 Github repository

NA

Integer signedness error in the qmail_put and substdio_put functions in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote malicious users to cause a denial of service and possibly execute arbitrary code via a large number of SMTP RCPT TO...

Dan Bernstein Qmail

NA

commands.c in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote malicious users to cause a denial of service and possibly execute arbitrary code via a long SMTP command without a space character, which causes an array to be referenced wi...

Dan Bernstein Qmail

7.5

CVSSv3

qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.

Netqmail Netqmail 1.06 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Canonical Ubuntu Linux 20.04

5.5

CVSSv3

qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's...

Netqmail Netqmail 1.06 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Canonical Ubuntu Linux 20.04

7

CVSSv3

A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

Gnu Glibc 2.5

1 EDB exploit

7.8

CVSSv3

A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

Gnu Glibc 2.1.1

1 EDB exploit

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook