Quassel-Irc Quassel vulnerabilities

14 known vulnerabilities affecting quassel-irc/quassel.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL1HIGH6MEDIUM7

Vulnerabilities

Page 1 of 1

CVE-2021-34825HIGHCVSS 7.5≤ 0.13.12021-06-17

CVE-2021-34825 [HIGH] CWE-319 CVE-2021-34825: Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usab Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system.

nvdosv

CVE-2018-1000178CRITICALCVSS 9.8v0.12.42018-05-08

CVE-2018-1000178 [CRITICAL] CWE-787 CVE-2018-1000178: A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStream A heap corruption of type CWE-120 exists in quassel version 0.12.4 in quasselcore in void DataStreamPeer::processMessage(const QByteArray &msg) datastreampeer.cpp line 62 that allows an attacker to execute code remotely.

nvdosv

CVE-2018-1000179HIGHCVSS 7.5v0.12.42018-05-08

CVE-2018-1000179 [HIGH] CWE-476 CVE-2018-1000179: A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreA A NULL Pointer Dereference of CWE-476 exists in quassel version 0.12.4 in the quasselcore void CoreAuthHandler::handle(const Login &msg) coreauthhandler.cpp line 235 that allows an attacker to cause a denial of service.

nvdosv

CVE-2016-4414HIGHCVSS 7.5≤ 0.12.32016-06-13

CVE-2016-4414 [HIGH] CVE-2016-4414: The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attacker The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.

nvdosv

CVE-2015-8547HIGHCVSS 7.5≤ 0.10.02016-01-08

CVE-2015-8547 [HIGH] CWE-17 CVE-2015-8547: The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.

nvdosv

CVE-2015-3427HIGHCVSS 7.5≤ 0.12.12015-05-14

CVE-2015-3427 [HIGH] CVE-2015-3427: Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL datab Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.

nvdosv

CVE-2015-2778MEDIUMCVSS 5.0≤ 0.11.02015-04-10

CVE-2015-2778 [MEDIUM] CWE-399 CVE-2015-2778: Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remo Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.

nvdosv

CVE-2015-2779MEDIUMCVSS 5.0≤ 0.11.02015-04-10

CVE-2015-2779 [MEDIUM] CWE-399 CVE-2015-2779: Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 al Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage.

nvdosv

CVE-2014-8483MEDIUMCVSS 5.0≥ 0, < 0.10.0-2.12014-11-06

CVE-2014-8483 [MEDIUM] CVE-2014-8483: The blowfishECB function in core/cipher The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.

osv

CVE-2013-6404MEDIUMCVSS 4.0≥ 0, < 0.9.2-12013-12-09

CVE-2013-6404 [MEDIUM] CVE-2013-6404: Quassel core (server daemon) in Quassel IRC before 0 Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.

osv

CVE-2010-3443MEDIUMCVSS 5.0≥ 0, < 0.7.1-12013-11-23

CVE-2010-3443 [MEDIUM] CVE-2010-3443: ctcphandler ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message.

osv

CVE-2013-4422MEDIUMCVSS 6.8≥ 0, < 0.9.1-12013-10-23

CVE-2013-4422 [MEDIUM] CVE-2013-4422: SQL injection vulnerability in Quassel IRC before 0 SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.

osv

CVE-2011-3354MEDIUMCVSS 5.0Exploited≤ 0.7.2v0.3.0+12 more2011-10-04

CVE-2011-3354 [MEDIUM] CWE-399 CVE-2011-3354: The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote atta The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.

nvdosv

CVE-2008-5657HIGHCVSS 7.5≥ 0, < 0.2~rc1-1.12008-12-17

CVE-2008-5657 [HIGH] CVE-2008-5657: CRLF injection vulnerability in Quassel Core before 0 CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP message.

osv