Latest Mit Vulnerabilities

● CVE-2023-39975
kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copi...
MIT Kerberos 5>=1.21<1.21.2
● CVE-2023-36054
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs becaus...
MIT Kerberos 5<1.20.2
MIT Kerberos 5=1.21
MIT Kerberos 5=1.21-beta1
Debian Debian Linux=10.0
Netapp Active Iq Unified Manager Vmware Vsphere
NetApp Clustered Data ONTAP=9.0
and 3 more
● CVE-2022-42898
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) ...
MIT Kerberos 5>=1.8<1.19.4
MIT Kerberos 5=1.20
MIT Kerberos 5=1.20-beta1
Heimdal Project Heimdal<7.7.1
Samba Samba<4.15.12
Samba Samba>=4.16.0<4.16.7
and 4 more
● CVE-2022-39028
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application wo...
debian/inetutils<=2:1.9.4-7+deb10u1
ubuntu/inetutils<2:1.9.4-11ubuntu0.2
ubuntu/inetutils<2:2.2-2ubuntu0.1
ubuntu/inetutils<2:2.3-5
GNU inetutils<=2.3
MIT Kerberos 5<=1.0.3
and 2 more
● CVE-2020-27428
A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
Mit Scratch-svg-renderer=0.2.0
● CVE-2021-37750
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field...
MIT Kerberos 5<1.18.5
MIT Kerberos 5>=1.19.0<1.19.3
Fedoraproject Fedora=33
Debian Debian Linux=9.0
Starwindsoftware Starwind Virtual San=v8r13-14338
Oracle Communications Cloud Native Core Network Slice Selection Function=22.1.0
● CVE-2021-36222
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference a...
debian/krb5<=1.17-3+deb10u1<=1.17-3<=1.18.3-5
debian/krb5
MIT Kerberos 5<1.18.4
MIT Kerberos 5>=1.19.0<1.19.2
Debian Debian Linux=10.0
Netapp Active Iq Unified Manager Vmware Vsphere
and 5 more
● CVE-2021-32471
Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbitrary code via crafted data. For example, a tape head may hav...
Mit Universal Turing Machine
● CVE-2019-25017
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, th...
MIT krb5-appl<=1.0.3
● CVE-2020-28196
MIT Kerberos 5 (aka krb5) is vulnerable to a denial of service, caused by an unbounded recursion flaw in lib/krb5/asn.1/asn1_encode.c. By sending a specially-crafted ASN.1-encoded Kerberos message, a ...
redhat/krb5<0:1.18.2-8.el8
redhat/redhat-virtualization-host<0:4.4.6-20210527.3.el8_4
debian/krb5
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
and 15 more
● CVE-2020-7750
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM ...
Mit Scratch-svg-renderer=0.1.0
Mit Scratch-svg-renderer=0.1.0-prerelease1515799461
Mit Scratch-svg-renderer=0.1.0-prerelease1515800444
Mit Scratch-svg-renderer=0.1.0-prerelease20180117145116
Mit Scratch-svg-renderer=0.1.0-prerelease20180117210827
Mit Scratch-svg-renderer=0.1.0-prerelease20180118201049
and 80 more
● CVE-2020-14000
MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execu...
npm/scratch-vm<=0.2.0-prerelease.20200709173451
Mit Scratch-vm<0.2.0-prerelease.20200714185213
● CVE-2019-14844
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user...
MIT Kerberos 5>=1.16.1<=1.17.1
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Fedoraproject Fedora=31
● CVE-2018-20217
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4...
MIT Kerberos<5-1.17
Debian Debian Linux=8.0
Debian Debian Linux=9.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203