Search CVE reports
1 – 10 of 53814 results
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming...
1 affected package
ruby-omniauth
| Package | 20.04 LTS |
|---|---|
| ruby-omniauth | Needs evaluation |
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log...
2 affected packages
h2o, dnsdist
| Package | 20.04 LTS |
|---|---|
| h2o | Needs evaluation |
| dnsdist | Not affected |
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing...
2 affected packages
h2o, dnsdist
| Package | 20.04 LTS |
|---|---|
| h2o | Needs evaluation |
| dnsdist | Not affected |
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list...
2 affected packages
ansible, ansible-core
| Package | 20.04 LTS |
|---|---|
| ansible | Needs evaluation |
| ansible-core | — |
Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior,...
1 affected package
dulwich
| Package | 20.04 LTS |
|---|---|
| dulwich | Needs evaluation |
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is...
1 affected package
rails
| Package | 20.04 LTS |
|---|---|
| rails | Needs evaluation |
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A...
1 affected package
netrek-client-cow
| Package | 20.04 LTS |
|---|---|
| netrek-client-cow | Needs evaluation |
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or...
1 affected package
netrek-client-cow
| Package | 20.04 LTS |
|---|---|
| netrek-client-cow | Needs evaluation |
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or...
1 affected package
mojarra
| Package | 20.04 LTS |
|---|---|
| mojarra | Needs evaluation |
In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination...
2 affected packages
frr, quagga
| Package | 20.04 LTS |
|---|---|
| frr | Needs evaluation |
| quagga | Needs evaluation |