CVSS: 7.8EPSS: 7%CPEs: 18EXPL: 4CVE-2019-6116 – Ghostscript 9.26 - Pseudo-Operator Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-6116
23 Jan 2019 — In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. En Artifex Ghostscript hasta la versión 9.26, los procedimientos ephemeral o transient pueden permitir el acceso a los operadores del sistema, lo que conduce a la ejecución remota de código. It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this f... • https://www.exploit-db.com/exploits/46242 •
CVSS: 5.3EPSS: 0%CPEs: 35EXPL: 0CVE-2018-17189 – httpd: mod_http2: DoS via slow, unneeded request bodies
https://notcve.org/view.php?id=CVE-2018-17189
23 Jan 2019 — In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections. En Apache HTTP Server, en sus versiones 2.4.37 y anteriores, mediante el envío de cuerpos de respuesta mediante la técnica del "slow loris" a recursos planos, la transmisión h2 para esa petición ocupó de forma innecesaria un hilo de servidor que... • http://www.securityfocus.com/bid/106685 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2018-17199 – httpd: mod_session_cookie does not respect expiry time
https://notcve.org/view.php?id=CVE-2018-17199
23 Jan 2019 — In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded. En Apache HTTP Server 2.4, en sus distribuciones 2.4.37 y anteriores, mod_session comprueba el tiempo de caducidad de la sesión antes de descodificarla. Esto provoca que se ignore el tiempo de caducidad de la sesión para sesiones mod_session_cookie,... • http://www.securityfocus.com/bid/106742 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2019-6212
https://notcve.org/view.php?id=CVE-2019-6212
23 Jan 2019 — Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordaron múltiples problemas de corrupción de memoria con la mejora de la gestión de memoria. Este problema se ha resuelto en iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 para Windows y iCloud para Windows 7.10. • http://www.securityfocus.com/bid/106691 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 29%CPEs: 9EXPL: 1CVE-2019-6215 – WebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter
https://notcve.org/view.php?id=CVE-2019-6215
23 Jan 2019 — A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution. Se abordó un problema de confusión de tipos con la mejora de la gestión de memoria. Este problema se ha resuelto en iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 para Windows y iCloud para Windows 7.10. • https://www.exploit-db.com/exploits/46448 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 3CVE-2019-6706 – Lua 5.3.5 - 'debug.upvaluejoin' Use After Free
https://notcve.org/view.php?id=CVE-2019-6706
23 Jan 2019 — Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships. Lua 5.3.5 tiene un uso de memoria previamente liberada en lua_upvaluejoin en lapi.c. Por ejemplo, un atacante podría lograr un cierre inesperado al desencadenar una llamada debug.upvaluejoin en la que los argumentos tienen ciertas relaciones. Lua version 5.3.5 suffers from a use-after-free... • https://www.exploit-db.com/exploits/46246 • CWE-416: Use After Free •
CVSS: 9.3EPSS: 7%CPEs: 11EXPL: 2CVE-2019-3462
https://notcve.org/view.php?id=CVE-2019-3462
22 Jan 2019 — Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. El saneamiento incorrecto de un campo de redirección 302 en el método HTTP "transport" en apt, en versiones 1.4.8 y anteriores, puede conducir a la inyección de contenido por parte de un atacante MITM, lo que puede conducir a la ejecución remota de código en el equipo objetivo. • https://github.com/tonejito/check_CVE-2019-3462 •
CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 0CVE-2019-2455 – mysql: Server: Parser unspecified vulnerability (CPU Jan 2019)
https://notcve.org/view.php?id=CVE-2019-2455
16 Jan 2019 — Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availab... • http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html •
CVSS: 4.9EPSS: 0%CPEs: 23EXPL: 0CVE-2019-2510 – mysql: InnoDB unspecified vulnerability (CPU Jan 2019)
https://notcve.org/view.php?id=CVE-2019-2510
16 Jan 2019 — Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html •
CVSS: 4.9EPSS: 0%CPEs: 22EXPL: 0CVE-2019-2532 – mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2019)
https://notcve.org/view.php?id=CVE-2019-2532
16 Jan 2019 — Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availabili... • http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html •