Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42 results
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-55639 · Other software · neutrinolabs · reported by GitHubMedium 5.3
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation phase, the parser fails to perform sufficient length validation for the incoming data block. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed data. Due to missing bounds checks, the xrdp process may read a small number of bytes beyond the declared data block boundary, potentially disclosing process memory contents that could be combined with other vulnerabilities. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-55626 · Other software · neutrinolabs · reported by GitHubHigh 8
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-55645 · Other software · neutrinolabs · reported by GitHubMedium 6.5
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted, truncated Client Control PDU. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service.This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-55238 · Other software · neutrinolabs · reported by GitHubMedium 5.3
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed capability data. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-54538 · Other software · neutrinolabs · reported by GitHubHigh 7.5
xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet that forces the xrdp process or thread into an infinite, CPU-bound loop. Because the internal pointer fails to advance and the deadlock prevention mechanism is bypassed for specific protocol data unit types, the process consumes excessive CPU resources indefinitely. This can render the xrdp service unavailable and potentially lead to system-wide resource exhaustion if multiple malicious connections are established. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-44978 · Other software · neutrinolabs · reported by GitHubMedium 5.3
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-44178 · Other software · neutrinolabs · reported by GitHubHigh 8.8
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-42218 · Other software · neutrinolabs · reported by GitHubMedium 5.3
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-41521 · Other software · neutrinolabs · reported by GitHubHigh 8.2
xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service (DoS) via a process crash. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026xrdp is an open source RDP server.CVE-2026-41252 · Other software · neutrinolabs · reported by GitHubCritical 9.8
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with out-of-range values, leading to an out-of-bounds write on the heap. This memory corruption can result in a denial of service (DoS) or potentially allow remote code execution (RCE) prior to authentication. This issue has been fixed in version 0.10.6.1.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-35512 · Other software · neutrinolabs · reported by GitHubHigh 8.7
xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication exploitation can crash the process, while post-authentication exploitation may achieve remote code execution. This issue has been fixed in version 0.10.6. If users are unable to immediately update, they should run xrdp as a non-privileged user (default since 0.10.2) to limit the impact of successful exploitation.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-33689 · Other software · neutrinolabs · reported by GitHubHigh 8.7
xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service's memory space. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-33145 · Other software · neutrinolabs · reported by GitHubMedium 6.3
xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-33516 · Other software · neutrinolabs · reported by GitHubHigh 7.7
xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerability by sending a specially crafted Confirm Active PDU. Successful exploitation could lead to a denial of service (process crash) or potential disclosure of sensitive information from the process memory. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32624 · Other software · neutrinolabs · reported by GitHubMedium 6.3
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer. This can corrupt adjacent memory regions, potentially leading to a Denial of Service (DoS) or unexpected behavior. The domain_name_separator directive is commented out by default, systems are not affected by this vulnerability unless it is intentionally configured. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32623 · Other software · neutrinolabs · reported by GitHubHigh 7.7
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32107 · Other software · neutrinolabs · reported by GitHubHigh 8.8
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026xrdp is an open source RDP server.CVE-2026-32105 · Other software · neutrinolabs · reported by GitHubCritical 9.3
xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026xrdp is an open source RDP server.CVE-2025-68670 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2024xrdp is an open source RDP server.CVE-2024-39917 · Other software · neutrinolabs · reported by GitHubHigh 7.2
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023xrdp is an open source remote desktop protocol server.CVE-2023-42822 · Other software · neutrinolabs · reported by GitHubMedium 4.6
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023xrdp is an open source remote desktop protocol (RDP) server.CVE-2023-40184 · Other software · neutrinolabs · reported by GitHubLow 2.6
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23493 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23484 · Other software · neutrinolabs · reported by GitHubHigh 8.2
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23483 · Other software · neutrinolabs · reported by GitHubHigh 7.5
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23482 · Other software · neutrinolabs · reported by GitHubNone
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23481 · Other software · neutrinolabs · reported by GitHubNone
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23480 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23479 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23478 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23477 · Other software · neutrinolabs · reported by GitHubCritical 9.1
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2022xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).CVE-2022-23468 · Other software · neutrinolabs · reported by GitHubMedium 6.5
xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2022xrdp is an open source remote desktop protocol (RDP) server.CVE-2022-23613 · Other software · neutrinolabs · reported by GitHubHigh 7.8
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2021In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificatesCVE-2021-36158 · Other software · Alpinelinux · reported by MITREMedium 5.9
In the xrdp package (in branches through 3.14) for Alpine Linux, RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificates and private keys are used.
- Product
- Aports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.alpinelinux.orggitlab.alpinelinux.org
Jun 30, 2020The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload.CVE-2020-4044 · Other software · neutrinolabs · reported by GitHubHigh 7.5
The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Nov 23, 2017The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows CVE-2017-16927 · Other software · Neutrinolabs · reported by MITREHigh 8.4
The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Mar 17, 2017xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potentialCVE-2017-6967 · Other software · Neutrinolabs · reported by MITREHigh 7.3
xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so bypass.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Dec 16, 2016An issue was discovered in xrdp before 0.9.1.CVE-2013-1430 · Other software · Neutrinolabs · reported by security@debian.orgCritical 9.8
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 20, 2010The (1) proofserv, (2) xrdcp, (3) xrdpwdadmin, and (4) xrd scripts in ROOT 5.18/00 place a zero-length directory name in the LD_LIBRARY_PATH, which allows localCVE-2010-3376 · Other software · Root · reported by MITREMedium 6.9
The (1) proofserv, (2) xrdcp, (3) xrdpwdadmin, and (4) xrd scripts in ROOT 5.18/00 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
- Product
- Root
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orgbugs.debian.org
Jan 15, 2009The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown impact via input data thaCVE-2008-5904 · Other software · Xrdp · reported by MITREHigh 7.5
The rdp_rdp_process_color_pointer_pdu function in rdp/rdp_rdp.c in xrdp 0.4.1 and earlier allows remote RDP servers to have an unknown impact via input data that sets crafted values for certain length variables, leading to a buffer overflow.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgopenwall.com
Jan 15, 2009Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors tCVE-2008-5903 · Other software · Xrdp · reported by MITREHigh 7.5
Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the edit_pos structure member.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgopenwall.com
Jan 15, 2009Buffer overflow in the xrdp_bitmap_invalidate function in xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via a cCVE-2008-5902 · Other software · Xrdp · reported by MITREHigh 7.5
Buffer overflow in the xrdp_bitmap_invalidate function in xrdp/xrdp_bitmap.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via a crafted request.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.