Total
295 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-5420 | 3 Debian, Fedoraproject, Rubyonrails | 3 Debian Linux, Fedora, Rails | 2023-11-07 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit. | |||||
| CVE-2019-1549 | 1 Openssl | 1 Openssl | 2023-11-07 | 5.0 MEDIUM | 5.3 MEDIUM |
| OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). | |||||
| CVE-2019-1543 | 1 Openssl | 1 Openssl | 2023-11-07 | 5.8 MEDIUM | 7.4 HIGH |
| ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j). | |||||
| CVE-2019-12821 | 1 Jisiwei | 2 I3, I3 Firmware | 2023-11-07 | 5.8 MEDIUM | 4.8 MEDIUM |
| A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code follows an easily predictable pattern that depends only on the specific device ID of the robot vacuum cleaner. By generating a QR-code containing information about the device ID, it is possible to connect an arbitrary device and gain full access to it. The device ID has an initial "JSW" substring followed by a six digit number that depends on the specific device. | |||||
| CVE-2019-10084 | 1 Apache | 1 Impala | 2023-11-07 | 4.6 MEDIUM | 7.5 HIGH |
| In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique and random, but have not been documented or consistently treated as sensitive secrets. Therefore they may be exposed in logs or interfaces. They were also not generated with a cryptographically secure random number generator, so are vulnerable to random number generator attacks that predict future IDs based on past IDs. Impala deployments with Apache Sentry or Apache Ranger authorization enabled may be vulnerable to privilege escalation if an authenticated attacker is able to hijack a session or query from another authenticated user with privileges not assigned to the attacker. Impala deployments with audit logging enabled may be vulnerable to incorrect audit logging as a user could undertake actions that were logged under the name of a different authenticated user. Constructing an attack requires a high degree of technical sophistication and access to the Impala system as an authenticated user. | |||||
| CVE-2023-31147 | 2 C-ares Project, Fedoraproject | 2 C-ares, Fedora | 2023-10-31 | N/A | 6.5 MEDIUM |
| c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. | |||||
| CVE-2020-27213 | 1 Ethernut | 1 Nut\/os | 2023-10-27 | N/A | 7.5 HIGH |
| An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. While the ISN generator seems to adhere to RFC 793 (where a global 32-bit counter is incremented roughly every 4 microseconds), proper ISN generation should aim to follow at least the specifications outlined in RFC 6528. | |||||
| CVE-2020-2099 | 1 Jenkins | 1 Jenkins | 2023-10-25 | 7.5 HIGH | 8.6 HIGH |
| Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents. | |||||
| CVE-2020-27635 | 1 Capgemini | 1 Picotcp | 2023-10-13 | N/A | 9.1 CRITICAL |
| In PicoTCP 1.7.0, TCP ISNs are improperly random. | |||||
| CVE-2020-27634 | 1 Contiki-ng | 1 Contiki-ng | 2023-10-13 | N/A | 9.1 CRITICAL |
| In Contiki 4.5, TCP ISNs are improperly random. | |||||
| CVE-2020-27633 | 1 Butok | 1 Fnet | 2023-10-13 | N/A | 9.1 CRITICAL |
| In FNET 4.6.3, TCP ISNs are improperly random. | |||||
| CVE-2020-27630 | 1 Silabs | 1 Uc\/tcp-ip | 2023-10-13 | N/A | 9.8 CRITICAL |
| In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. | |||||
| CVE-2020-27631 | 1 Oryx-embedded | 1 Cyclonetcp | 2023-10-13 | N/A | 9.8 CRITICAL |
| In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random. | |||||
| CVE-2020-27636 | 1 Microchip | 1 Mplab Network Creator | 2023-10-13 | N/A | 9.1 CRITICAL |
| In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random. | |||||
| CVE-2020-17470 | 1 Butok | 1 Fnet | 2023-10-12 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies DNS cache poisoning attacks. | |||||
| CVE-2023-3373 | 1 Mitsubishielectric | 4 Gs21, Gs21 Firmware, Gt21 and 1 more | 2023-08-10 | N/A | 9.1 CRITICAL |
| Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 and prior and GOT SIMPLE Series GS21 model versions 01.49.000 and prior allows a remote unauthenticated attacker to hijack data connections (session hijacking) or prevent legitimate users from establishing data connections (to cause DoS condition) by guessing the listening port of the data connection on FTP server and connecting to it. | |||||
| CVE-2022-29330 | 1 Vitalpbx | 1 Vitalpbx | 2023-08-08 | 4.0 MEDIUM | 4.9 MEDIUM |
| Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors. | |||||
| CVE-2022-32296 | 1 Linux | 1 Linux Kernel | 2023-08-08 | 2.1 LOW | 3.3 LOW |
| The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056. | |||||
| CVE-2021-28099 | 1 Netflix | 1 Hollow | 2023-08-08 | 3.6 LOW | 4.4 MEDIUM |
| In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated. | |||||
| CVE-2021-45487 | 1 Netbsd | 1 Netbsd | 2023-08-08 | 5.0 MEDIUM | 7.5 HIGH |
| In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures. | |||||