Vulnerabilidades do Netapp Steelstore Cloud Integrated Storage

CVE-2019-17267 Crítica · 9.8 CWE-502 06/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

CVE-2019-16943 Crítica · 9.8 CWE-502 01/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

CVE-2019-16942 Crítica · 9.8 CWE-502 01/10/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

CVE-2019-5482 Crítica · 9.8 CWE-787 16/09/2019

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE-2019-16335 Crítica · 9.8 CWE-502 15/09/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

CVE-2019-14540 Crítica · 9.8 CWE-502 15/09/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

CVE-2019-16168 Média · 6.5 CWE-369 09/09/2019

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

CVE-2019-13272 Alta · 7.8 KEV Urgente · 76 Exploit público 17/07/2019

Linux Kernel Improper Privilege Management Vulnerability

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

CVE-2019-5436 Alta · 7.8 CWE-787 28/05/2019

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in...

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVE-2019-9169 Crítica · 9.8 CWE-125 25/02/2019

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has...

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

CVE-2018-14719 Crítica · 9.8 CWE-502 02/01/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

CVE-2018-14718 Crítica · 9.8 CWE-502 02/01/2019

Deserialization of Untrusted Data em Fasterxml Jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

CVE-2016-9841 Crítica · 9.8 23/05/2017

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified…

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.