Sinec Infrastructure Network Services

CVEs (68)

• CVE-2020-8231HigDec 14, 2020
  Curl

  Libcurl
  risk 0.49cvss 7.5epss 0.04

  Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

• CVE-2020-8169HigDec 14, 2020
  Curl

  Curl
  risk 0.49cvss 7.5epss 0.03

  curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).

• CVE-2020-13871HigJun 6, 2020
  SQLite

  SQLite
  risk 0.49cvss 7.5epss 0.04

  SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.

• CVE-2020-11655HigApr 9, 2020
  SQLite

  SQLite
  risk 0.49cvss 7.5epss 0.04

  SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

• CVE-2020-9327HigFeb 21, 2020
  SQLite

  SQLite
  risk 0.49cvss 7.5epss 0.04

  In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.

• CVE-2021-32804HigAug 3, 2021
  Tar Project

  Tar
  risk 0.48cvss 8.2epss 0.15

  The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into…

• CVE-2021-32803HigAug 3, 2021
  Tar Project

  Tar
  risk 0.47cvss 8.2epss 0.08

  The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not…

• CVE-2021-37713HigAug 31, 2021
  Npmjs

  Tar
  risk 0.46cvss 8.2epss 0.01

  The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not…

• CVE-2021-37712HigAug 31, 2021
  Npmjs

  Tar
  risk 0.46cvss 8.2epss 0.02

  The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This…

• CVE-2020-7774HigNov 17, 2020
  Y18n Project

  Y18n
  risk 0.46cvss 7.3epss 0.69

  The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

• CVE-2020-13630HigMay 27, 2020
  SQLite

  SQLite
  risk 0.46cvss 7.0epss 0.01

  ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

• CVE-2021-3712HigAug 24, 2021
  OpenSSL Project

  OpenSSL
  risk 0.45cvss 7.4epss 0.50

  ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is…

• CVE-2020-8287MedJan 6, 2021
  Node.js

  Node.js
  risk 0.44cvss 6.5epss 0.16

  Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request…

• CVE-2021-25214MedApr 29, 2021
  Isc

  Bind
  risk 0.43cvss 6.5epss 0.06

  In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of…

• CVE-2021-3449MedMar 25, 2021
  OpenSSL Project

  OpenSSL
  risk 0.43cvss 5.9epss 0.63

  An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a…

• CVE-2020-8285HigDec 14, 2020
  Curl

  Curl
  risk 0.43cvss 7.5epss 0.10

  curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

• CVE-2021-22946HigSep 29, 2021
  Curl

  Curl
  risk 0.42cvss 7.5epss 0.05

  A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed…

• CVE-2021-27290HigMar 12, 2021
  Ssri Project

  Ssri
  risk 0.42cvss 7.5epss 0.05

  ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

• CVE-2019-19244HigNov 25, 2019
  SQLite

  SQLite
  risk 0.42cvss 7.5epss 0.03

  sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.

• CVE-2020-1971MedDec 8, 2020
  OpenSSL Project

  OpenSSL
  risk 0.39cvss 5.9epss 0.07

  The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This…