CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-0299
https://notcve.org/view.php?id=CVE-2010-0299
22 Feb 2010 — openSUSE 11.2 installs the devtmpfs root directory with insecure permissions (1777), which allows local users to gain privileges via unspecified vectors. openSUSE 11.2 instala el directorio principal de devmpfs con permisos inseguros (1777), lo que permite a usuarios locales obtener privilegios a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 0CVE-2010-0623
https://notcve.org/view.php?id=CVE-2010-0623
15 Feb 2010 — The futex_lock_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem. La función futex_lock_pi en kernel/futex.c en el kernel de Linux anterior a 2.6.33-rc7 no maneja adecuadamente determinadas cuentas de referencia, lo que permite a usuarios locales provocar una denegación de servicio (OOPS) a través de vectores que involucran ... • http://bugzilla.kernel.org/show_bug.cgi?id=14256 •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2010-0230
https://notcve.org/view.php?id=CVE-2010-0230
22 Jan 2010 — SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to listen on all network interfaces, which might allow remote attackers to bypass intended access restrictions. SUSE Linux Enterprise versión 10 SP3 (SLE10-SP3) y openSUSE versión 11.2 configura Postfix para escuchar en todas las interfaces de la red, lo que podría permitir a los atacantes remotos omitir las restricciones de acceso previstas. • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 96%CPEs: 10EXPL: 1CVE-2009-3953 – Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2009-3953
13 Jan 2010 — The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994. La implementación U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podría permitir a atacantes ejecutar código de su elección ... • https://www.exploit-db.com/exploits/16622 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 5%CPEs: 10EXPL: 1CVE-2010-0013 – Pidgin MSN 2.6.4 - File Download
https://notcve.org/view.php?id=CVE-2010-0013
09 Jan 2010 — Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon. Vulne... • https://www.exploit-db.com/exploits/11203 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2010-0012
https://notcve.org/view.php?id=CVE-2010-0012
08 Jan 2010 — Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file. Vulnerabilidad de salto de directorio en libtransmission/metainfo.c en Transmission v1.22, v1.34, v1.75, y v1.76 permite a atacantes remotos sobreescribir ficheros de su elección a través de .. (punto punto) en un nombre de ruta con un fichero .torrent • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.3EPSS: 94%CPEs: 11EXPL: 4CVE-2009-4324 – Adobe Acrobat and Reader Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2009-4324
15 Dec 2009 — Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009. La vulnerabilidad de uso de la memoria previamente liberada (Use-after-free) en la función Doc.media.newPlayer en el archivo Multimedia.api en Adobe Reader y Acrobat versión 9.x anterior a 9.3, y ... • https://www.exploit-db.com/exploits/16503 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 25EXPL: 0CVE-2009-3080 – kernel: gdth: Prevent negative offsets in ioctl
https://notcve.org/view.php?id=CVE-2009-3080
20 Nov 2009 — Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request. Error de indice de matriz en la función gdth_read_event en drivers/scsi/gdth.c en el kernel de Linux antes de v2.6.32-RC8 permite a usuarios locales provocar una denegación de servicio o posiblemente obtener privilegios a través de un índice de evento negativo en una solicitud... • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=690e744869f3262855b83b4fb59199cf142765b0 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-129: Improper Validation of Array Index •
CVSS: 7.1EPSS: 0%CPEs: 29EXPL: 1CVE-2009-3939 – kernel: megaraid_sas permissions in sysfs
https://notcve.org/view.php?id=CVE-2009-3939
16 Nov 2009 — The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file. El fichero poll_mode_io para el controlador megaraid_sas en el kernel de Linux v2.6.31.6 y anteriores tiene permisos de escritura para todos, permitiendo a usuarios locales cambiar el modo de E/S del dispositivo modificando este fichero. • http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2009-2816
https://notcve.org/view.php?id=CVE-2009-2816
13 Nov 2009 — The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page. La implementación de Cross-Origin Resource Sharing (CORS) en WebKit, tal como es usado en Safari de Apple anterior a versión 4.0.4 y Chrome d... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html • CWE-352: Cross-Site Request Forgery (CSRF) •