Product:

Znc

(Znc)
Repositories https://github.com/znc/znc
#Vulnerabilities 13
Date Id Summary Products Score Patch Annotated
2020-06-02 CVE-2020-13775 ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network. Fedora, Znc 6.5
2019-03-27 CVE-2019-9917 ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding. Ubuntu_linux, Fedora, Znc 6.5
2019-06-15 CVE-2019-12816 Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name. Znc 8.8
2019-11-12 CVE-2010-2488 NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections. Znc N/A
2018-07-14 CVE-2018-14056 ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories. Debian_linux, Znc 5.3
2018-07-14 CVE-2018-14055 ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf. Debian_linux, Znc 6.5
2014-12-19 CVE-2014-9403 The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by adding a channel with the same name as an existing channel but without the leading # character, related to a "use-after-delete" error. Znc N/A
2014-06-05 CVE-2013-2130 ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp. Znc N/A
2010-08-17 CVE-2010-2934 Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service (exception and daemon crash) via unknown vectors related to "unsafe substr() calls." Znc N/A
2010-08-17 CVE-2010-2812 Client.cpp in ZNC 0.092 allows remote attackers to cause a denial of service (exception and daemon crash) via a PING command that lacks an argument. Znc N/A