CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-0367 – Having LocalisationCache directory default to system tmp directory is insecure
https://notcve.org/view.php?id=CVE-2017-0367
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure. Mediawiki, en versiones anteriores a la 1.28.1 y la 1.27.2, contiene un uso inseguro de un directorio temporal, en el que tener por defecto el directorio LocalisationCache en el directorio system tmp no es seguro. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0368 – Make rawHTML mode not apply to system messages
https://notcve.org/view.php?id=CVE-2017-0368
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error que hace que el modo rawHTML se aplique a los mensajes del sistema. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0369 – Sysops can undelete pages, although the page is protected against it
https://notcve.org/view.php?id=CVE-2017-0369
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error que permite que un sysops deshaga la eliminación de páginas aunque esta esté protegida contra ello. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-276: Incorrect Default Permissions •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-0370 – Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter
https://notcve.org/view.php?id=CVE-2017-0370
13 Apr 2018 — Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter. Mediawiki, en versiones anteriores a la 1.28.1, 1.27.2 y la 1.23.16, contiene un error por el cual la lista negra de Spam no es efectiva en URL embebidas en el parámetro link de la sintaxis de inclusión de archivos. • https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 6%CPEs: 5EXPL: 0CVE-2018-1308 – Debian Security Advisory 4194-1
https://notcve.org/view.php?id=CVE-2018-1308
09 Apr 2018 — This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=
CVSS: 7.8EPSS: 44%CPEs: 29EXPL: 1CVE-2018-1000156 – patch: Malicious patch files cause ed to execute arbitrary commands
https://notcve.org/view.php?id=CVE-2018-1000156
06 Apr 2018 — GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time. La versión 2.7.6 de GNU Patch contiene una vulnerabilidad de validación de entradas al procesar archivos patch; espe... • https://packetstorm.news/files/id/154124 • CWE-20: Improper Input Validation CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-9258
https://notcve.org/view.php?id=CVE-2018-9258
04 Apr 2018 — In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources. En Wireshark desde la versión 2.4.0 hasta la 2.4.5, el disector TCP podría cerrarse inesperadamente. Esto se trató en epan/dissectors/packet-tcp.c preservando los orígenes válidos de datos. • https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14472 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2018-9260
https://notcve.org/view.php?id=CVE-2018-9260
04 Apr 2018 — In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring that an allocation step occurs. En Wireshark 2.4.0 a 2.4.5 y 2.2.0 a 2.2.13, el disector IEEE 802.15.4 podría cerrarse inesperadamente. Esto se abordó en epan/dissectors/packet-ieee802154.c garantizando que ocurre un paso de asignación. • https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14468 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-9261 – Debian Security Advisory 4217-1
https://notcve.org/view.php?id=CVE-2018-9261
04 Apr 2018 — In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-nbap.c by prohibiting the self-linking of DCH-IDs. En Wireshark 2.4.0 a 2.4.5 y 2.2.0 a 2.2.13, el disector NBAP podría cerrarse inesperadamente con un gran bucle que termina con un desbordamiento de búfer basado en memoria dinámica (heap). Esto se trató en epan/dissectors/packet-nbap.c c prohibiendo el autoenlazado de DCH... • https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14471 • CWE-834: Excessive Iteration •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2018-9263
https://notcve.org/view.php?id=CVE-2018-9263
04 Apr 2018 — In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonzero key length. En Wireshark 2.4.0 a 2.4.5 y 2.2.0 a 2.2.13, el disector Kerberos podría cerrarse inesperadamente. Esto se trató en epan/dissectors/packet-kerberos.c garantizando una longitud de clave que no sea cero. • https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14576 •