CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2011-4315
https://notcve.org/view.php?id=CVE-2011-4315
Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response. Desbordamiento de búfer basado en memoria dinámica en el procesamiento de compresión puntero en core/ngx_resolver.c en nginx antes de v1.0.10 permite a resolvers remotos causar una denegación de servicio (caída del demonio) o posiblemente tener un impacto no especificado a través de una respuesta larga. • http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070569.html http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00005.html http://openwall.com/lists/oss-security/2011/11/17/10 http://openwall.com/lists/oss-security/2011/11/17/8 http://secunia.com/advisories/47097 http://secunia.com/advisories/48577 http://security.gentoo.org/glsa/glsa-201203-22.xml http://trac.nginx.org/nginx/changeset/4268/nginx http://www.nginx.org/en/CHANGES-1.0 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 9%CPEs: 6EXPL: 6CVE-2011-4107 – phpMyAdmin 3.3.x/3.4.x - Local File Inclusion via XML External Entity Injection
https://notcve.org/view.php?id=CVE-2011-4107
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack. La función simplexml_load_string en la importación XML plug-in (libraries/import/xml.php) en phpMyAdmin v3.4.x anterior a v3.4.7.1, v3.3.x y v3.3.10.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a través de datos XML que contiene entidad de referencia externa, también conocido como un XML entidad externa (XXE) ataque de inyección. phpMyAdmin versions 3.3.x and 3.4.x suffer from a local file inclusion vulnerability via XXE injection. The attacker must be logged in to MySQL via phpMyAdmin. • https://www.exploit-db.com/exploits/18371 https://github.com/SECFORCE/CVE-2011-4107 http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html http://osvdb.org/76798 http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt http://seclists.org/fulldisclosure/2011/Nov/21 http://secunia.com/adviso • CWE-611: Improper Restriction of XML External Entity Reference •