Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.
Max CVSS
7.5
EPSS Score
0.21%
Published
2021-06-17
Updated
2022-07-12
A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp line 235 that allows an attacker to cause a denial of service.
Max CVSS
7.5
EPSS Score
0.44%
Published
2018-05-08
Updated
2020-10-26
A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.
Max CVSS
9.8
EPSS Score
1.62%
Published
2018-05-08
Updated
2020-10-26
The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.
Max CVSS
7.5
EPSS Score
2.65%
Published
2016-06-13
Updated
2018-10-30
The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
Max CVSS
7.5
EPSS Score
2.83%
Published
2016-01-08
Updated
2018-10-30
Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
Max CVSS
7.5
EPSS Score
0.11%
Published
2015-05-14
Updated
2016-12-06
Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.
Max CVSS
5.0
EPSS Score
4.21%
Published
2015-04-10
Updated
2016-12-03
Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Max CVSS
5.0
EPSS Score
2.35%
Published
2015-04-10
Updated
2016-12-03
The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.
Max CVSS
5.0
EPSS Score
3.76%
Published
2011-10-04
Updated
2017-08-29
9 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!