Vulnerabilidades de Broadcom
CVEs publicadas que afetam produtos de Broadcom: 210 registro(s), com severidade, exploração e correções.
Fabric Operating System 66Rabbitmq Server 26Brocade Active Support Connectivity Gateway 15Brocade Fabric Operating System Firmware 13Dx Netops Spectrum 10BCM5820X 8Vmware Avi Load Balancer 7Spring Web Services 7Sannav 6Spring Tools 6Brocade Sannav 5Spring Data Commons 5Spring Authorization Server 4Reactor Netty 4Spring Batch 3Symantec Endpoint Protection Windows Client 2Brocade Fabric Operating System 2Spring Web Flow 2Reactor Core 2Symantec Management Suite 1Symantec IT Management Suite 1Symantec Messaging Gateway 1Spring Rest Docs 1Symantec Endpoint Detection and Response 1SiteMinder 1Data Loss Prevention 1Spring Cloud Commons 1Unified Infrastructure Management 1Symantec Web Security Services Agent 1Symantec Endpoint Protection CleanWipe Removal Tool 1Layer 7 API Gateway 1Symantec Siteminder 1Automic Automation 1Spring Statemachine 1Spring Cloud Sleuth 1Spring Retry 1Spring Data Redis 1Spring Data Keyvalue 1Spring Data Relational 1
CVE-2020-35493
Média · 5.5
CWE-20 04/01/2021
Improper Input Validation em Gnu Binutils
A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.
CVE-2020-15778
Alta · 7.4
CWE-78 24/07/2020
scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
CVE-2020-13632
Média · 5.5
CWE-476 27/05/2020
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted...
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
CVE-2020-13631
Média · 5.5
27/05/2020
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables...
SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
CVE-2020-13630
Alta · 7.0
CWE-416 27/05/2020
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the...
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
CVE-2020-12243
Alta · 7.5
CWE-674 28/04/2020
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean...
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
CVE-2020-1967
Alta · 7.5
CWE-476 21/04/2020
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
CVE-2019-19054
Média · 4.7
CWE-401 18/11/2019
Missing Release of Memory after Effective Lifetime em Linux Linux Kernel
A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.
CVE-2018-1273
Crítica · 9.8
KEV Urgente · 77 Exploit público Ransomware CWE-94 11/04/2018
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2014-0160
Alta · 7.5
KEV Urgente · 79 Exploit público CWE-125 07/04/2014
OpenSSL Information Disclosure Vulnerability
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.