CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-8277
https://notcve.org/view.php?id=CVE-2019-8277
UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212. La revisión 1211 de UltraVNC contiene múltiples fugas de memoria en el código del servidor VNC, un atacante podría leer la pila de memoria pudiendo revelar información. • https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-024-ultravnc-improper-initialization https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 https://www.us-cert.gov/ics/advisories/icsa-20-161-06 • CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2019-8276
https://notcve.org/view.php?id=CVE-2019-8276
UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service (DoS). This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212. UltraVNC, en su revisión 1211, tiene una vulnerabilidad de desbordamiento de búfer basado en pila en el código del servidor VNC dentro del manipulador de peticiones de trasferencia de datos, lo que puede resultar en una denegación de servicio (DoS). Este ataque parece ser explotable mediante la conectividad de red. • https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-023-ultravnc-stack-based-buffer-overflow https://www.us-cert.gov/ics/advisories/icsa-20-161-06 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 10%CPEs: 4EXPL: 0CVE-2019-8275
https://notcve.org/view.php?id=CVE-2019-8275
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212. UltraVNC, en su revisión 1211, tiene múltiples vulnerabilidades de terminación nulo en el código del servidor VNC, lo que podría resultar en un acceso de datos fuera de límites por parte de usuarios remotos. Este ataque parece ser explotable mediante la conectividad de red. • https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-022-ultravnc-improper-null-termination https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 https://www.us-cert.gov/ics/advisories/icsa-20-161-06 • CWE-170: Improper Null Termination •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2019-8274
https://notcve.org/view.php?id=CVE-2019-8274
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212. UltraVNC, en su revisión 1211, tiene una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap) en el código del servidor VNC dentro de un manipulador de oferta de trasferencia de archivos, lo que podría resultar en, potencialmente, la ejecución de código. Este ataque parece ser explotable mediante la conectividad de red. • https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-021-ultravnc-heap-based-buffer-overflow https://www.us-cert.gov/ics/advisories/icsa-20-161-06 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2019-8273
https://notcve.org/view.php?id=CVE-2019-8273
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212. UltraVNX, en su revisión 1211, tiene una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap) en el código del servidor VNC dentro de un manipulador de peticiones de trasferencia de archivos, lo que podría resultar en, potencialmente, la ejecución de código. Este ataque parece ser explotable mediante la conectividad de red. • https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-020-ultravnc-heap-based-buffer-overflow https://www.us-cert.gov/ics/advisories/icsa-20-161-06 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •