|
2781
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect m…
|
CWE-330
Use of Insufficiently Random Values
|
CVE-2026-44054
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2782
|
7.5 |
HIGH
Network
|
-
|
-
|
A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.
|
CWE-78
OS Command
|
CVE-2026-44055
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2783
|
6.4 |
MEDIUM
Network
|
-
|
-
|
A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data.
|
CWE-121
Stack-based Buffer Overflow
|
CVE-2026-44056
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2784
|
7.2 |
HIGH
Network
|
-
|
-
|
An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.
|
CWE-287
Improper Authentication
|
CVE-2026-44058
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2785
|
4.5 |
MEDIUM
Local
|
-
|
-
|
A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause a minor service disruption.
|
CWE-362
Race Condition
|
CVE-2026-44059
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2786
|
7.5 |
HIGH
Network
|
-
|
-
|
An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.
|
CWE-191
Integer Underflow (Wrap or Wraparound)
|
CVE-2026-44060
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2787
|
5.9 |
MEDIUM
Network
|
-
|
-
|
Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.
|
CWE-208
Information Exposure Through Timing Discrepancy
|
CVE-2026-44061
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2788
|
7.5 |
HIGH
Network
|
-
|
-
|
A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted …
|
CWE-787
Out-of-bounds Write
|
CVE-2026-44062
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2789
|
4.2 |
MEDIUM
Network
|
-
|
-
|
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted fil…
|
CWE-90
LDAP Injection
|
CVE-2026-44063
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2790
|
7.1 |
HIGH
Adjacent
|
-
|
-
|
An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.
|
CWE-125
Out-of-bounds Read
|
CVE-2026-44064
|
2026-05-22 00:20 |
2026-05-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
