PatchTheCVEznc vulnerabilities
Recent CVEs affecting znc products. 11 tracked.
znc has 11 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2020-12-08. Highest priority: CVE-2020-29577 (score 65/100).
- CVE-2020-29577 CRITICAL 9.8 DOWNGRADE The official znc docker images before 1.7.1-slim contain a blank password for a root user
- CVE-2020-13775 MEDIUM 6.5 DOWNGRADE MITIGATE ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dere
- CVE-2019-9917 MEDIUM 6.5 UPGRADE MITIGATE ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
- CVE-2019-12816 HIGH 8.8 UPGRADE Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and exe
- CVE-2018-14056 MEDIUM 5.3 UPGRADE MITIGATE ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of t
- CVE-2018-14055 MEDIUM 6.5 UPGRADE MITIGATE ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin
- CVE-2014-9403 MEDIUM 4.0 UPGRADE The CWebAdminMod::ChanPage function in modules/webadmin.cpp in ZNC before 1.4 allows remote authenticated user
- CVE-2013-7049 MEDIUM 4.3 UPGRADE Stack-based buffer overflow in fish.cpp in the Fish plugin for ZNC, as used in ZNC for Windows (znc-msvc) 0.20
- CVE-2013-2130 MEDIUM 4.0 DOWNGRADE ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via
- CVE-2012-0033 MEDIUM 5.0 DOWNGRADE The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in the bouncedcc module in ZNC 0.200 and 0.202 allows
- CVE-2010-2488 HIGH 7.5 UPGRADE NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthentica
FAQ
How do I fix znc vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is znc being exploited right now?
None of the tracked znc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which znc CVE should I patch first?
CVE-2020-29577 currently ranks highest (65/100): The official znc docker images before 1.7.1-slim contain a blank password for a root user.