CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2007-3153
https://notcve.org/view.php?id=CVE-2007-3153
The ares_init:randomize_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (Unix rand), which makes it easier for remote attackers to spoof DNS responses by guessing certain values. La función ares_init:randomize_key en c-ares, sobre plataformas diferentes a windows, utiliza una facilidad debil para producir una secuencia de número aleatorio (Unix rand), la cual hace más fácil para el atacante remotos envenenar las respuestas DNS adivinando ciertos valores. • http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup http://osvdb.org/37172 http://www.securityfocus.com/bid/24386 https://exchange.xforce.ibmcloud.com/vulnerabilities/34980 •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2007-3152
https://notcve.org/view.php?id=CVE-2007-3152
c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attackers to spoof DNS responses by guessing the field value. c-ares anterior a 1.4.0 utiliza un germen para el generador de númers aleatorios para el campo DNS Transaction ID, el cual podría permitir a atacantes remotos suplantar la respuesta DNS a adivinando el valor del campo. • http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup http://osvdb.org/37171 http://secunia.com/advisories/25579 http://www.securityfocus.com/bid/24386 https://exchange.xforce.ibmcloud.com/vulnerabilities/34979 •
CVSS: 7.5EPSS: 3%CPEs: 3EXPL: 0CVE-2006-1061
https://notcve.org/view.php?id=CVE-2006-1061
Heap-based buffer overflow in cURL and libcURL 7.15.0 through 7.15.2 allows remote attackers to execute arbitrary commands via a TFTP URL (tftp://) with a valid hostname and a long path. • http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1326.html http://curl.haxx.se/docs/adv_20060320.html http://secunia.com/advisories/19271 http://secunia.com/advisories/19335 http://secunia.com/advisories/19344 http://secunia.com/advisories/19371 http://www.gentoo.org/security/en/glsa/glsa-200603-19.xml http://www.osvdb.org/23982 http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00048.html http://www.securityfocus.com/bid/17154 http://www •
CVSS: 4.6EPSS: 0%CPEs: 11EXPL: 0CVE-2005-4077
https://notcve.org/view.php?id=CVE-2005-4077
Multiple off-by-one errors in the cURL library (libcurl) 7.11.2 through 7.15.0 allow local users to trigger a buffer overflow and cause a denial of service or bypass PHP security restrictions via certain URLs that (1) are malformed in a way that prevents a terminating null byte from being added to either a hostname or path buffer, or (2) contain a "?" separator in the hostname portion, which causes a "/" to be prepended to the resulting string. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.16/SCOSA-2006.16.txt http://curl.haxx.se/docs/adv_20051207.html http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2006/May/msg00003.html http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://qa.openoffice.org/issues/show_bug.cgi?id=59032 http://secunia.com/advisories/17907 http://secunia.com/advisories/17960 http://secunia.com/advisories/17961& • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 12%CPEs: 2EXPL: 2CVE-2002-1868 – Dispair 0.1/0.2 - Remote Command Execution
https://notcve.org/view.php?id=CVE-2002-1868
Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields. • https://www.exploit-db.com/exploits/21679 http://www.contactor.se/~dast/dispair/dispair.cgi?file=dispair-0.3.tar.gz&dir=&view=CHANGES http://www.iss.net/security_center/static/9787.php http://www.securityfocus.com/bid/5392 •