Main Vulnerability Database SB2022072819

SB2022072819 - Multiple vulnerabilities in DELL Secure Connect Gateway Security

Published: July 28, 2022 Updated: December 13, 2024

Security Bulletin ID SB2022072819

Severity

Critical

Patch available

YES

Number of vulnerabilities 167

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 167 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2022-0850)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the copy_page_to_iter() function in iov_iter.c in Linux kernel. A local user can gain unauthorized access to sensitive information on the system.

2) Information disclosure (CVE-ID: CVE-2022-0002)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to non-transparent sharing of branch predictor within a context. A local user can gain unauthorized access to sensitive information on the system.

3) Use-after-free (CVE-ID: CVE-2022-0487)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. A local user can trigger a use-after-free error and gain access to sensitive information.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-0492)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a logic error within the cgroup_release_agent_write() function in kernel/cgroup/cgroup-v1.c. A local user can use the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation.

5) NULL pointer dereference (CVE-ID: CVE-2022-0617)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel UDF file system functionality. A local user can supply a malicious UDF image to the udf_file_write_iter() function and perform a denial of service (DoS) attack.

6) Reachable Assertion (CVE-ID: CVE-2022-0644)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion error in the Linux kernel’s kernel_read_file_from_fd in the filesystem. A local user can attempt to read a file without read access/permission to perform a denial of service (DoS) attack.

7) Information disclosure (CVE-ID: CVE-2022-0812)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c() function in RPCRDMA_HDRLEN_MIN (7). A local user can gain unauthorized access to sensitive information on the system.

8) Use of uninitialized resource (CVE-ID: CVE-2022-0847)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an uninitialized resources. A local user can overwrite arbitrary file in the page cache, even if the file is read-only, and execute arbitrary code on the system with elevated privileges.

The vulnerability was dubbed Dirty Pipe.

9) Use-after-free (CVE-ID: CVE-2022-1011)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the write() function of FUSE filesystem. A local user can retireve (partial) /etc/shadow hashes and execute arbitrary code with elevated privileges.

10) Use-after-free (CVE-ID: CVE-2021-45868)

The vulnerability allows a local user to perform a denial-of-service attack.

The vulnerability exists due to fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). A local user can trigger use-after-free error and perform a denial-of-service attack.

11) Use-after-free (CVE-ID: CVE-2022-1016)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in net/netfilter/nf_tables_core.c:nft_do_chain in Linux kernel.. A local user can trigger a use-after-free error and gain access to sensitive information.

12) Use-after-free (CVE-ID: CVE-2022-1048)

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to a use-after-free error in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. A local user can execute arbitrary code with elevated privileges and perform a denial-of-service attack.

13) Use-after-free (CVE-ID: CVE-2022-1280)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a use-after-free error within the drm_lease_held() function in drivers/gpu/drm/drm_lease.c in the Linux kernel. A local user can run a specially crafted program to trigger a use-after-free error and crash the kernel or gain access to sensitive information.

14) Information disclosure (CVE-ID: CVE-2022-1353)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the pfkey_register function in net/key/af_key.c in the Linux kernel. A local user can gain unauthorized access to kernel memory, leading to a system crash or a leak of internal kernel information.

15) Use-after-free (CVE-ID: CVE-2022-1419)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in vgem_gem_dumb_create() function in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

16) NULL pointer dereference (CVE-ID: CVE-2022-1516)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference error in the Linux kernel’s X.25 set of standardized network protocols functionality. A local user can terminate session using a simulated Ethernet card and perform a denial of service (DoS) attack.

17) Race condition (CVE-ID: CVE-2022-23036)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a race condition in the blkfront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

18) Race condition (CVE-ID: CVE-2022-23037)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a race condition in the netfront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

19) Information disclosure (CVE-ID: CVE-2022-0001)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to non-transparent sharing of branch predictor selectors between contexts. A local user can gain unauthorized access to sensitive information on the system.

20) NULL pointer dereference (CVE-ID: CVE-2021-44879)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the gc_data_segment() function in fs/f2fs/gc.c. A local user can mount a specially crafted f2fs image, trigger a NULL pointer dereference and perform a denial of service (DoS) attack.

21) Race condition (CVE-ID: CVE-2022-23039)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a race condition in the gntalloc ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

22) Improper input validation (CVE-ID: CVE-2022-21349)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the 2D component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

23) Improper input validation (CVE-ID: CVE-2022-21293)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

24) Improper input validation (CVE-ID: CVE-2022-21294)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

25) Improper input validation (CVE-ID: CVE-2022-21296)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

26) Improper input validation (CVE-ID: CVE-2022-21299)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

27) Improper input validation (CVE-ID: CVE-2022-21305)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

28) Improper input validation (CVE-ID: CVE-2022-21340)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

29) Improper input validation (CVE-ID: CVE-2022-21341)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

30) Improper input validation (CVE-ID: CVE-2022-21360)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the ImageIO component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

31) Improper Validation of Array Index (CVE-ID: CVE-2021-43389)

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to improper validation of array index in the ISDN CAPI implementation within detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can send specially crafted data to the system and execute arbitrary code with elevated privileges.

32) Improper input validation (CVE-ID: CVE-2022-21365)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

33) HTTP request smuggling attack (CVE-ID: CVE-2017-7658)

The disclosed vulnerability allows a remote attacker to conduct an HTTP request smuggling attack on the target system.

The vulnerability exists due to improper handling HTTP requests that contain more than one content-length header. A remote attacker can send a specially crafted HTTP request that contains a transfer-encoding header and a content-length header, cause the software and an upstream HTTP agent to misinterpret the boundary of the request and to poison the web cache on the system, which could be used to conduct further attacks.

34) Security restrictions bypass (CVE-ID: CVE-2018-7755)

The vulnerability allows a local unauthenticated attacker to bypass security restrictions on the target system.

The weakness exists in the drivers/block/floppy.c source code in the fd_locked_ioctl function due to insufficient security restrictions. A local attacker can bypass security restrictions through the system floppy drive and obtain kernel code and data from the system.

35) Input validation error (CVE-ID: CVE-2019-20811)

The vulnerability allows a local authenticated user to manipulate data.

An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.

36) Use-after-free (CVE-ID: CVE-2021-20292)

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a use-after-free error in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. A local user can escalate privileges and execute code in the context of the kernel.

37) Race condition (CVE-ID: CVE-2021-20321)

The vulnerability allows a local user to perform a denial of service (DoS) attacks.

The vulnerability exists due to a race condition when accessing file object in the Linux kernel OverlayFS subsystem. A local user can rename files in specific way with OverlayFS and perform a denial of service (DoS) attack.

38) NULL pointer dereference (CVE-ID: CVE-2021-38208)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the net/nfc/llcp_sock.c component. A remote attacker can make getsockname call and perform a denial of service (DoS) attack.

39) Security features bypass (CVE-ID: CVE-2021-39713)

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to multiple issues in Qdisc implementation related to rcu read lock. A local application can execute arbitrary code with elevated privileges.

40) Race condition (CVE-ID: CVE-2022-23038)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a race condition in the scsifront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

41) Race condition (CVE-ID: CVE-2022-23040)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a race condition in the xenbus ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

42) Improper input validation (CVE-ID: CVE-2022-21283)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

43) Infinite loop (CVE-ID: CVE-2021-3737)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker who controls a malicious server can force the client to enter an infinite loop on a 100 Continue response.

44) SQL injection (CVE-ID: CVE-2022-24407)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of password in the SQL plugin shipped with Cyrus SASL. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

45) Resource exhaustion (CVE-ID: CVE-2017-16932)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in parser.c function due to improper handling of certain parameter entities. A remote attacker can supply specially constructed XML data, trigger resource exhaustion and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

46) Integer overflow (CVE-ID: CVE-2022-29824)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*). A remote attacker can pass specially crafted multi-gigabyte XML file to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

47) Use-after-free (CVE-ID: CVE-2022-23308)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing ID and IDREF attributes in valid.c. A remote attacker can pass specially crafted XML input to the application, trigger a use-after-free error and crash the application or execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

48) Deserialization of Untrusted Data (CVE-ID: CVE-2021-4104)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in JMSAppender, when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution.

Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default.

49) Improper input validation (CVE-ID: CVE-2021-3572)

The vulnerability allows a remote authenticated user to manipulate data.

The vulnerability exists due to improper input validation within the Policy (python-pip) component in Oracle Communications Cloud Native Core Policy. A remote authenticated user can exploit this vulnerability to manipulate data.

50) Resource management error (CVE-ID: CVE-2021-3733)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application within the AbstractBasicAuthHandler class in urllib. A remote attacker with control over the server can perform regular expression denial of service attack during authentication.

51) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-4189)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in the FTP (File Transfer Protocol) client library when using it in PASV (passive) mode. A remote attacker can set up a malicious FTP server, trick the FTP client in Python into connecting back to a given IP address and port, which can lead to FTP client scanning ports which otherwise would not have been possible.

52) Out-of-bounds read (CVE-ID: CVE-2019-20838)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and X or R has more than one fixed quantifier, a related issue to CVE-2019-20454.

53) CRLF injection (CVE-ID: CVE-2022-0391)

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data within the urllib.parse module in Python. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

54) SQL injection (CVE-ID: CVE-2022-29155)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the experimental back-sql backend to slapd during an LDAP search operation when the search filter is processed. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

55) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2020-25613)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

56) Command Injection (CVE-ID: CVE-2021-31799)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

57) Information disclosure (CVE-ID: CVE-2021-31810)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists within Net::FTP in Ruby when processing PASV responses. A remote attacker can trick the victim to connect to a malicious FTP server and trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).

58) Improper Certificate Validation (CVE-ID: CVE-2021-32066)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists in Net::IMAP in Ruby, due to the gem does not raise an exception when StartTLS fails with an an unknown response. A remote attacker can perform a man-in-the-middle (MitM) attack.

59) Buffer overflow (CVE-ID: CVE-2018-25032)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when compressing data. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

60) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-1552)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to incorrectly imposed security restrictions in Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck. A remote authenticated user with permission to create non-temp objects can execute arbitrary SQL functions under a superuser identity and escalate privileges within the application.

61) Integer overflow (CVE-ID: CVE-2020-14155)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote attacker can pass a large number after a (?C substring, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

62) Buffer overflow (CVE-ID: CVE-2017-7246)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in pcre32_copy_substring() function in pcre_get.c in libpcre1 in PCRE 8.40. A remote unauthenticated attacker can create a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

63) Race condition (CVE-ID: CVE-2022-23041)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to a race condition in blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls ring buffers. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

64) Double Free (CVE-ID: CVE-2022-28388)

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to boundary error in the usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code with elevated privileges.

65) Reachable Assertion (CVE-ID: CVE-2022-23042)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to reachable assertion in the netfront ring buffer. A malicious backend can exploit the race condition and read or write data or perform a denial of service attack.

66) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2022-23960)

The vulnerability allows a local user to obtain potentially sensitive information.

The vulnerability exists due to improper restrictions of cache speculation. A local user can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches and gain access to sensitive information.

The vulnerability was dubbed Spectre-BHB.

67) Missing initialization of resource (CVE-ID: CVE-2022-24448)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to missing initialization of resource within the fs/nfs/dir.c in the Linux kernel. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.

68) Memory leak (CVE-ID: CVE-2022-24959)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the yam_siocdevprivate() function in drivers/net/hamradio/yam.c. A local user can perform a denial of service attack.

69) Buffer overflow (CVE-ID: CVE-2022-26490)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the st21nfca_connectivity_event_received() function in drivers/nfc/st21nfca/se.c in Linux kernel. A local user can run a specially crafted program to trigger buffer overflow and execute arbitrary code with elevated privileges.

70) Use-after-free (CVE-ID: CVE-2022-26966)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error in drivers/net/usb/sr9700.c in the Linux kernel. A remote attacker can pass specially crafted data and obtain sensitive information from heap memory.

71) Heap-based buffer overflow (CVE-ID: CVE-2022-27666)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c in Linux kernel. A local unprivileged user can pass specially crafted data to the system, trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.

72) Memory leak (CVE-ID: CVE-2022-28356)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in net/llc/af_llc.c component. A remote attacker can force the system to leak memory and perform denial of service attack.

73) Double Free (CVE-ID: CVE-2022-28389)

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to boundary error in mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code with elevated privileges.

74) Buffer overflow (CVE-ID: CVE-2017-7245)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in pcre32_copy_substring() function in pcre_get.c in libpcre1 in PCRE 8.40. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

75) Double Free (CVE-ID: CVE-2022-28390)

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to boundary error in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c. A local user can pass specially crafted data to the application, trigger double free error and execute arbitrary code with elevated privileges.

76) Memory leak (CVE-ID: CVE-2022-28748)

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due memory leak when working with ax88179_178a devices. An attacker with physical access to the system can inject a malicious USB-drive and remotely obtain data from kernel memory.

77) UNIX symbolic link following (CVE-ID: CVE-2021-28153)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue, when g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

78) Infinite loop (CVE-ID: CVE-2022-0778)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.

79) Integer overflow (CVE-ID: CVE-2021-43618)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in mpz/inp_raw.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

80) Out-of-bounds read (CVE-ID: CVE-2017-7186)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to a segmentation violation issue by the libpcre1 and libpcre2. A remote attacker can send specially crafted packets and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

81) Out-of-bounds read (CVE-ID: CVE-2017-7244)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to invalid memory read flaw in the _pcre32_xclass function in pcre_xclass.c. A remote attacker can trick the victim into loading a specially crafted file and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

82) Improper input validation (CVE-ID: CVE-2022-21291)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

83) Improper input validation (CVE-ID: CVE-2022-21282)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

84) Authentication bypass (CVE-ID: CVE-2017-3167)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to usage of the ap_get_basic_auth_pw() function by third-party modules outside of the authentication phase. A remote attacker can create a specially crafted HTTP request to vulnerable web server, bypass authentication requirements and gain unauthorized access to otherwise protected information.

85) Open redirect (CVE-ID: CVE-2020-1927)

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data in some "mod_rewrite" configurations. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

86) Race condition (CVE-ID: CVE-2019-0217)

The vulnerability allows a remote authenticated user to impersonate other users.

The vulnerability exists due to a race condition within the mod_auth_digests module. A remote authenticated attacker can send a series of requests and impersonate other users under a threaded MPM.

87) Input validation error (CVE-ID: CVE-2019-0220)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the web server does not merge consecutive slashes in URLs, that can lead to incorrect processing of requests when accessing CGI programs. Such web server behavior may lead to security restrictions bypass.

88) Resource management error (CVE-ID: CVE-2019-9517)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect implementation of HTTP/2 protocol. A remote attacker can open the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

89) Out-of-bounds write (CVE-ID: CVE-2019-10081)

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a boundary error when processing HTTP/2 requests within the mod_http2 module, configured with "H2PushResource". A remote attacker can send specially crafted HTTP/2 requests to the affected server and perform denial of service (DoS) attack.

90) Use-after-free (CVE-ID: CVE-2019-10082)

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the mod_http2 when handling connection shutdown. A remote attacker can send specially crafted requests to the affected server and make the mod_http2 to read memory that was already freed.

91) Cross-site scripting (CVE-ID: CVE-2019-10092)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data on the mod_proxy error page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

92) Input validation error (CVE-ID: CVE-2019-10098)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to incorrect handling of encoded line break characters within rewrite rules. A remote attacker can send a specially crafted HTTP request and potentially bypass security restrictions.

93) Use of Uninitialized Variable (CVE-ID: CVE-2020-1934)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the "mod_proxy_ftp" may use uninitialized memory when proxying to a malicious FTP server. A remote attacker can gain unauthorized access to sensitive information on the target system.

94) Path traversal (CVE-ID: CVE-2020-1938)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Apache Tomcat AJP connector. A remote attacker can send a specially crafted AJP request, include and execute arbitrary files on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

95) Input validation error (CVE-ID: CVE-2020-9490)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing Cache-Digest header in HTTP/2 request. A remote attacker can pass specially crafted HTTP/2 request to the Apache HTTP Server, trigger the server to send the HTTP/2 PUSH and perform a denial of service (DoS) attack.

96) Resource management error (CVE-ID: CVE-2020-11993)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application while processing HTTP/2 requests with enabled trace/debug for HTTP/2 connections. A remote attacker can send specially crafted HTTP/2 requests to Apache HTTP Server and force it to make logging statements on wrong connection for certain traffic edge patterns. This results in concurrent use of memory pools for separate connections and triggers denial of service condition.

97) Stack-based buffer overflow (CVE-ID: CVE-2020-35452)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing Digest nounces in mod_auth_digest. A remote unauthenticated attacker can send a specially crafted HTTP request, trigger stack overflow by one nul byte and crash the server.

98) NULL pointer dereference (CVE-ID: CVE-2021-26690)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mod_session. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

99) NULL pointer dereference (CVE-ID: CVE-2021-26691)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mod_session. A a malicious backend server or SessionHeader can trigger a denial of service (DoS) condition.

100) Input validation error (CVE-ID: CVE-2021-30641)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect parsing of Apache configuration files. An unexpected section could be matched with 'MergeSlashes OFF' option, leading to a potential security issue.

101) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2021-33193)

The vulnerability allows a remote attacker to preform HTTP/2 request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests in mod_proxy in Apache HTTP Server. A remote attacker can send a specially crafted HTTP/2 request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison web server cache and perform phishing attacks.

102) NULL pointer dereference (CVE-ID: CVE-2021-34798)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted HTTP request to the affected web server and perform a denial of service (DoS) attack.

103) Privilege escalation (CVE-ID: CVE-2019-0211)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within MPM implementation due to the application does not properly maintain each child's listener bucket number in the scoreboard that may lead to unprivileged code or scripts run by server (e.g. via mod_php) to modify the scoreboard and abuse the privileged main process.

A local user can execute arbitrary code on the system with privileges of the Apache HTTP Server code process.

104) Resource management error (CVE-ID: CVE-2019-0197)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error within the mod_http2 module when processing update requests from http/1.1 to http/2, if this was not the first request on a connection. A remote attacker can send specially crafted requests to the affected server and perform denial of service attack.

Successful exploitation of the vulnerability requires that HTTP/2 protocol is enabled for a "http:" host or H2Upgrade is enabled for h2 on a "https:" host.

105) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-40438)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the mod_proxy module in Apache HTTP Server. A remote attacker can send a specially crafted HTTP request with a chosen uri-path and trick the web server to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

106) Security restrictions bypass (CVE-ID: CVE-2017-15715)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists on systems that allow uploading of user-specified filenames due to the '<FilesMatch>' expression may not correctly match characters in a filename. A remote attacker can supply a specially crafted filename to potentially bypass security controls that use the '<FilesMatch>' directive.

107) NULL pointer dereference (CVE-ID: CVE-2017-3169)

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a NULL pointer dereference error within mod_ssl module, when third-party modules call ap_hook_process_connection() function during an HTTP request to an HTTPS port. A remote attacker can send a specially crafted HTTP request and crash the affected web server.

108) NULL pointer dereference (CVE-ID: CVE-2017-7659)

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a NULL pointer dereference error within mod_http2. A remote attacker can send a specially crafted HTTP/2 request and crash the affected process.

Successful exploitation of the vulnerability result in denial of service (DoS) attack.

109) Out-of-bounds read (CVE-ID: CVE-2017-7679)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to out-of-bounds read within the mod_mime when constructing Content-Type response header. A remote attacker read one byte pas the end of a buffer when sending a malicious Content-Type response header.

110) Information disclosure (CVE-ID: CVE-2017-9788)

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the targeted system.

The weakness exists due to improper initialization of the value placeholder in [Proxy-]Authorization headers of type 'Digest' before or between successive key=value assignments by mod_auth_digest. A remote attacker can provide an initial key with no '=' assignment to cause the stale value of uninitialized pool memory used by the prior request to leak.

Successful exploitation of the vulnerability results in information disclosure.

111) Use-after-free error (CVE-ID: CVE-2017-9789)

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the targeted system.

The weakness exists due to use-after-free condition in the mod_http2 function. A remote attacker can trigger memory corruption and cause the server to crash.

Successful exploitation of the vulnerability results in denial of service.

112) Use-after-free (CVE-ID: CVE-2017-9798)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to use-after-free error when processing HTTP OPTIONS requests in server/core.c, when limits are configured in .htaccess or httpd.conf configuration files. A remote unauthenticated attacker can read portions of memory through HTTP OPTIONS requests and gain access to potentially sensitive data.

The vulnerability is dubbed Optionsbleed.

113) Out-of-bounds write (CVE-ID: CVE-2017-15710)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in HTTPD mod_authnz_ldap due to improper validation of user-supplied input. A remote attacker can send a specially crafted Accept-Language header value, trigger an out-of-bounds memory write error and potentially cause the target service to crash.

114) Improper access control (CVE-ID: CVE-2018-1283)

The vulnerability allows a remote attacker to modify data on the target system.

The weakness exists on systems with mod_session configured with SessionEnv on to forward session data to CGI applications due to improper input validation. A remote attacker can send a specially crafted 'Session' header value to potentially modify mod_session data.

115) Use-after-free (CVE-ID: CVE-2019-0196)

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a use-after-free error within the mod_http2 module when processing HTTP/2 requests. A remote attacker can make the application to access freed memory during string comparison when determining the method of a request and process the request incorrectly.

Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information or perform a denial of service attack.

116) Out-of-bounds read (CVE-ID: CVE-2018-1301)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper validation of user-supplied input. A remote attacker can send a specially crafted HTTP request to trigger an out-of-bounds memory access error after a header size limit has been reached to cause the target service to crash.

117) Null pointer dereference (CVE-ID: CVE-2018-1302)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper destruction of an HTTP/2 stream after being handled. A remote attacker can send a specially crafted HTTP/2 stream, write a NULL pointer value to an already freed memory space and cause the service to crash.

118) Out-of-bounds read (CVE-ID: CVE-2018-1303)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in Apache HTTPD mod_cache_socache due to improper validation of user-supplied input. A remote attacker can send a specially crafted HTTP request header, trigger an out-of-bounds memory read error in mod_cache_socache and cause the target service to crash.

119) Security restrictions bypass (CVE-ID: CVE-2018-1312)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists in Apache HTTPD mod_auth_digest due to improper generation of HTTP Digest authentication nonce. A remote attacker can replay HTTP requests across the cluster without detection by the target server(s) and bypass replay protection.

120) Improper input validation (CVE-ID: CVE-2018-1333)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insufficient filtering of incoming data within "mod_http2" apache module. A remote attacker can send a specially crafted HTTP request to the affected web server and trigger daemon crash.

121) Resource management error (CVE-ID: CVE-2018-11763)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect handling of large SETTINGS frames in HTTP/2 connections. A remote attacker can repeatedly send large SETTINGS frames within an established HTTP/2 connection and consume all available threads and CPU time.

Successful exploitation of the vulnerability may allow an attacker to perform a denial of service (DoS) attack.

122) Input validation error (CVE-ID: CVE-2018-17189)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to an error when handling malicious input. A remote attacker can send a specially crafted request bodies in a slow loris way to plain resources and cause the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data.

123) Security restrictions bypass (CVE-ID: CVE-2018-17199)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to mod_session checks the session expiry time before decoding the session. A remote attacker сan cause session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded and reuse old session credentials or session IDs, which the attacker could use to access web pages previously accessed by a targeted user.

124) Buffer overflow (CVE-ID: CVE-2021-39275)

The vulnerability allows a remote attacker to execute arbitrary code on the target system or perform a denial of service attack.

The vulnerability exists due to a boundary error within the ap_escape_quotes() function. A remote attacker can send a specially crafted request to the web server, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the Apache module passes untrusted data to the affected function.

According to vendor, No included modules pass untrusted data to these functions

125) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-44224)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in forward proxy configurations. A remote attacker can send a specially crafted HTTP request and trick the web server to initiate requests to arbitrary systems or cause NULL pointer dereference error and crash the web server.

SSRF if possible for configuration that mix forward and reverse proxy.

126) Improper input validation (CVE-ID: CVE-2022-21248)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

127) Code Injection (CVE-ID: CVE-2022-25235)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected application lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

128) Incorrect default permissions (CVE-ID: CVE-2021-41103)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for container root directories and some plugins. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host can discover, read, and modify those files.

129) Type Confusion (CVE-ID: CVE-2021-41190)

The vulnerability allows a remote attacker to compromise the system.

The vulnerability exists due to a type confusion error. A remote authenticated attacker can pass specially crafted data to the application, trigger a type confusion error and interpret the resulting content differently.

130) Security restrictions bypass (CVE-ID: CVE-2022-23648)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error when handling specially crafted image configuration in containerd where containers launched through containerd’s CRI implementation. A remote attacker can bypass any policy-based enforcement on container setup and access the read-only copies of arbitrary files and directories on the host.

131) Improper Authentication (CVE-ID: CVE-2022-22576)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when re-using OAUTH2 connections for SASL-enabled protocols, such as SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only). libcurl may reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. As a result, a connection that is successfully created and authenticated with a user name + OAUTH2 bearer can subsequently be erroneously reused even for user + [other OAUTH2 bearer], even though that might not even be a valid bearer.

A remote attacker can exploit this vulnerability against applications intended for use in multi-user environments to bypass authentication and gain unauthorized access to victim's accounts.

132) Information disclosure (CVE-ID: CVE-2022-27776)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to curl can leak authentication or cookie header data during HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme.

The vulnerability exists due to an incomplete fix for #VU10224 (CVE-2018-1000007).

133) Infinite loop (CVE-ID: CVE-2022-27781)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when handling requests with the CURLOPT_CERTINFO option. A remote attacker can consume all available system resources and cause denial of service conditions.

134) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2022-27782)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several TLS and SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party.

135) Input validation error (CVE-ID: CVE-2022-25236)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper protection against insertion of namesep characters into namespace URIs in xmlparse.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

136) Improper Preservation of Permissions (CVE-ID: CVE-2021-41091)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

137) Stack-based buffer overflow (CVE-ID: CVE-2022-25313)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in build_model. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

138) Integer overflow (CVE-ID: CVE-2022-25314)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in copyString. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

139) Integer overflow (CVE-ID: CVE-2022-25315)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in storeRawNames function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

140) Out-of-bounds write (CVE-ID: CVE-2022-1304)

The vulnerability allows a local attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A local attacker can use a specially crafted filesystem, trigger out-of-bounds write and execute arbitrary code on the target system.

141) Off-by-one (CVE-ID: CVE-2021-3999)

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to an off-by-one error glibc getcwd() function. A remote attacker can pass specially crafted input to the application that is using the affected library version, trigger an off-by-one error and execute arbitrary code on the target system.

142) Buffer overflow (CVE-ID: CVE-2022-23218)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the svcunix_create() in the sunrpc module ib glibc. A remote attacker can pass specially crafted input to the application that is using the affected library version, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

143) Buffer overflow (CVE-ID: CVE-2022-23219)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the clnt_create() function in the sunrpc module. A remote attacker can pass specially crafted input to the application that is using the affected library version, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

144) Input validation error (CVE-ID: CVE-2022-1271)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation when processing filenames with two or more newlines. A remote attacker can force zgrep or xzgrep to write arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

145) Information disclosure (CVE-ID: CVE-2021-41092)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.

146) Improper Preservation of Permissions (CVE-ID: CVE-2021-41089)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

147) Buffer overflow (CVE-ID: CVE-2021-44790)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing multipart content in mod_lua. A remote attacker can send a specially crafted HTTP request to the affected web server, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

148) Insufficiently protected credentials (CVE-ID: CVE-2019-12423)

The vulnerability allows a remote attacker to gain access ti sensitive information.

The vulnerability exists due to the application allows a client to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". A remote non-authenticated attacker can obtain all private key and secret key credentials and gain unauthorized access to the application.

149) Input validation error (CVE-ID: CVE-2022-22719)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized value in r:parsebody. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

150) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2022-22720)

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

151) Integer overflow (CVE-ID: CVE-2022-22721)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the ap_escape_html2() function when parsing LimitXMLRequestBody. A remote attacker can send a specially crafted request to the web server, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

152) Out-of-bounds write (CVE-ID: CVE-2022-23943)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in mod_sed. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

153) Resource management error (CVE-ID: CVE-2014-0230)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Tomcat does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body. A remote attacker can cause a denial of service (thread consumption) via a series of aborted upload attempts.

154) Improper access control (CVE-ID: CVE-2016-5388)

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable. A remote attacker can redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

155) Information disclosure (CVE-ID: CVE-2016-8745)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists to error within the send file code for the NIO HTTP connector, which causes current Processor object being added to the Processor cache multiple times. This behavior means that sharing the same Processor for concurrent requests can lead to leakage of potentially sensitive information between requests, such as session ID, request body, etc.

Successful exploitation of the vulnerability may allow an attacker to obtain potentially sensitive information.

156) Information disclosure (CVE-ID: CVE-2017-5647)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. A remote attacker can cause responses to appear to be sent for the wrong request.

157) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2019-17566)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of "xlink:href" attributes. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

158) Out-of-bounds write (CVE-ID: CVE-2021-44142)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing EA metadata while opening files in smbd within the VFS Samba module (vfs_fruit). A remote attacker with ability to write to file's extended attributes can trigger an out-of-bounds write and execute arbitrary code with root privileges.

Note, the vulnerability in vfs_fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file.

159) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2020-11987)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

160) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2020-11988)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the XMPParser in Apache XmlGraphics Commons. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

161) Infinite loop (CVE-ID: CVE-2021-41079)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing certain TLS packets. A remote attacker can send a specially crafted packet to the application, consume all available system resources and cause denial of service conditions.

Successful exploitation of vulnerability requires that Apache Tomcat is configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS.

162) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2022-27772)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a temporary directory hijacking. A local user can trigger the vulnerability and escalate privileges on the system.

163) Improper Authentication (CVE-ID: CVE-2020-25721)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to the application.

164) Buffer overflow (CVE-ID: CVE-2020-29361)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a unspecified boundary error, related to processing of RPC requests. A remote attacker can perform a denial of service (DoS) attack.

165) Link following (CVE-ID: CVE-2021-43566)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to a symlink race condition when creating directories. A remote authenticated user can use SMB1 or NFS symlink race to create directories on the Unix filesystem outside of the share definition.

Successful exploitation of the vulnerability requites that the user has permissions to create folder in the target directory.

166) Link following (CVE-ID: CVE-2021-44141)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insecure link following. A remote user with ability to write files to the exported part of the file system under a share via SMB1 unix extensions or via NFS can create a symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition.

167) Information disclosure (CVE-ID: CVE-2021-3800)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can trick the victim into opening a specially crafted file to gain unauthorized access to sensitive information on the system.

Remediation

Install update from vendor's website.

SB2022072819 - Multiple vulnerabilities in DELL Secure Connect Gateway Security

Breakdown by Severity

Description

Remediation

References

Please verify you're human