PatchTheCVEneon vulnerabilities and fixes
Recent CVEs affecting neon, with upgrade or downgrade steps. 9 tracked.
neon has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2020-08-27. Highest priority: CVE-2004-0179 (score 58/100).
- CVE-2020-23576 MEDIUM 5.4 DOWNGRADE Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
- CVE-2020-13890 MEDIUM 5.4 UPGRADE The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
- CVE-2019-20141 MEDIUM 6.1 DOWNGRADE An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php
- CVE-2009-2474 MEDIUM 5.8 UPGRADE UPGRADE neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name
- CVE-2009-2473 MEDIUM 4.3 DOWNGRADE neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allo
- CVE-2008-3746 MEDIUM 4.3 DOWNGRADE neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and cr
- CVE-2007-0157 HIGH 7.8 DOWNGRADE Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-
- CVE-2004-0398 HIGH 7.5 UPGRADE UPGRADE Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5
- CVE-2004-0179 MEDIUM 6.8 UPGRADE MITIGATE Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon includ
FAQ
How do I fix neon vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is neon being exploited right now?
None of the tracked neon CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which neon CVE should I patch first?
CVE-2004-0179 currently ranks highest (58/100): Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon includ.