彙總 cesnet 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 緩衝區溢位與SQL 注入 等問題，部分漏洞可能導致 應用程式崩潰，並影響 生產負載與軟體部署 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2023-26917 | libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c. | [email protected] | 7.5 | 0.30% | 2023-04-11 | 2025-02-11 |
| CVE-2023-26916 | libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c. | [email protected] | 5.3 | 0.19% | 2023-04-03 | 2025-02-18 |
| CVE-2016-15014 | A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functionality of the file cesnet/core/lostpassword/templates/resetpassword.php. The manipulation leads to insufficiently protected credentials. Attacking locally is a requirement. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 2b857f2233ce5083b4d5bc9bfc4152f933c3e4a6. It is recommended to upgrade the affe | [email protected] | 3.3 | 0.10% | 2023-01-07 | 2024-11-21 |
| CVE-2021-28906 | In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash. | [email protected] | 7.5 | 0.37% | 2021-05-20 | 2024-11-21 |
| CVE-2021-28905 | In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some cases, node->module can be null, which triggers a reachable assertion (CWE-617). | [email protected] | 7.5 | 0.40% | 2021-05-20 | 2024-11-21 |
| CVE-2021-28904 | In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision is NULL, the operation of strcmp(revision, ext_plugins[u].revision) will lead to a crash. | [email protected] | 7.5 | 0.40% | 2021-05-20 | 2024-11-21 |
| CVE-2021-28903 | A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursively, which will consume stack space and lead to crash. | [email protected] | 7.5 | 0.46% | 2021-05-20 | 2024-11-21 |
| CVE-2021-28902 | In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In some cases, it can be NULL, which leads to the operation of retval->ext[r]->flags that results in a crash. | [email protected] | 7.5 | 0.37% | 2021-05-20 | 2024-11-21 |
| CVE-2020-5281 | In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input. | [email protected] | 6.2 | 0.36% | 2020-03-25 | 2024-11-21 |
| CVE-2019-20398 | A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_restr_dup(). Applications that use libyang to parse untrusted input yang files may crash. | [email protected] | 6.5 | 0.21% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20397 | A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. | [email protected] | 8.8 | 0.29% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20396 | A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing. | [email protected] | 6.5 | 0.20% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20395 | A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash. | [email protected] | 6.5 | 0.21% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20394 | A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. | [email protected] | 8.8 | 0.21% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20393 | A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution. | [email protected] | 8.8 | 0.21% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20392 | An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash. | [email protected] | 6.5 | 0.15% | 2020-01-22 | 2024-11-21 |
| CVE-2019-20391 | An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash. | [email protected] | 6.5 | 0.15% | 2020-01-22 | 2024-11-21 |
| CVE-2019-19334 | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. | [email protected] | 9.8 | 0.35% | 2019-12-06 | 2024-11-21 |
| CVE-2019-19333 | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. | [email protected] | 9.8 | 0.45% | 2019-12-06 | 2024-11-21 |
| CVE-2019-15537 | The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php. | [email protected] | 9.8 | 0.26% | 2019-08-23 | 2024-11-21 |