CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-5803 – chromium-browser: CSP bypass with Javascript URLs
https://notcve.org/view.php?id=CVE-2019-5803
28 Mar 2019 — Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page. La insuficiente aplicación de políticas en Content Security Policy en Google Chrome antes de la versión 73.0.3683.75, permitió a un atacante remoto eludir la política de seguridad de contenido por medio de una página HTML creada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-5804 – Gentoo Linux Security Advisory 201903-23
https://notcve.org/view.php?id=CVE-2019-5804
28 Mar 2019 — Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform domain spoofing via a crafted domain name. Un procesamiento incorrecto de línea de comandos en Chrome en Google Chrome antes de la versión 73.0.3683.75, permitió que un atacante local ejecutara una falsificación de dominio mediante un nombre de dominio creado. Multiple vulnerabilities have been found in Chromium, the worst of which could result in the remote execution of code. Versions less... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-5794 – chromium-browser: Security UI spoofing
https://notcve.org/view.php?id=CVE-2019-5794
28 Mar 2019 — Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. El manejo incorrecto de peticiones canceladas en Navigation en Google Chrome antes de la versión 73.0.3683.75, permitió a un atacante remoto ejecutara una suplantación de dominio por medio de una página HTML creada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 73.0.3683.75. Issues add... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-5802 – chromium-browser: Security UI spoofing
https://notcve.org/view.php?id=CVE-2019-5802
28 Mar 2019 — Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. El manejo inadecuado de los orígenes de descarga en Navigation en Google Chrome antes de la versión 73.0.3683.75, permitió que un atacante remoto ejecutara una suplantación de dominios por medio de una página HTML creada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 73.0.3683.75. Issues... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 1CVE-2019-1787 – Clam AntiVirus PDF Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1787
27 Mar 2019 — A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A succ... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00062.html • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 13%CPEs: 4EXPL: 1CVE-2019-1788 – ClamAV OLE2 File Out-Of-Bounds Write Vulnerability
https://notcve.org/view.php?id=CVE-2019-1788
27 Mar 2019 — A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV So... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00062.html • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 9.1EPSS: 0%CPEs: 29EXPL: 1CVE-2019-9948 – python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms
https://notcve.org/view.php?id=CVE-2019-9948
23 Mar 2019 — urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call. urllib en Python, en versiones 2.x hasta la 2.7.16, soporta el esquema local_file:, lo que facilita que los atacantes remotos omitan los mecanismos de protección que ponen en lista negra los URI file:, tal y como queda demostrado con una llamada urllib.urlopen... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-749: Exposed Dangerous Method or Function •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2019-9924 – bash: BASH_CMD is writable in restricted bash shells
https://notcve.org/view.php?id=CVE-2019-9924
22 Mar 2019 — rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell. rbash en Bash USN-4058-1 fixed a vulnerability in bash. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. It was discovered that Bash incorrectly handled the restricted shell. An attacker could possibly use this issue to escape restrictions and execute any command. Various other issues were also address... • http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65 • CWE-138: Improper Neutralization of Special Elements CWE-862: Missing Authorization •
CVSS: 7.3EPSS: 0%CPEs: 17EXPL: 0CVE-2019-3838 – ghostscript: forceput in DefineResource is still accessible (700576)
https://notcve.org/view.php?id=CVE-2019-3838
22 Mar 2019 — It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Se ha observado que el operador forceput podía ser extraído del método DefineResource en ghostscript en las versiones anteriores a la 9.27. Un archivo PostScript especialmente manipulado podría explotar este error, por ejemplo, para ob... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00011.html • CWE-648: Incorrect Use of Privileged APIs •
CVSS: 9.1EPSS: 1%CPEs: 6EXPL: 0CVE-2019-3858 – libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read
https://notcve.org/view.php?id=CVE-2019-3858
19 Mar 2019 — An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory. Se ha descubierto un error de lectura fuera de límites en libssh2, en versiones anteriores a la 1.8.1, cuando un paquete SFTP especialmente manipulado se recibe desde el servidor. Un atacante remoto que comprometa un servidor SSH podría ser capaz de provoca... • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html • CWE-125: Out-of-bounds Read •