CVSS: 7.8EPSS: 4%CPEs: 43EXPL: 0CVE-2019-9517 – Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
https://notcve.org/view.php?id=CVE-2019-9517
13 Aug 2019 — Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both. Algunas implementaciones HT... • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 3%CPEs: 35EXPL: 0CVE-2019-9518 – Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
https://notcve.org/view.php?id=CVE-2019-9518
13 Aug 2019 — Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 5%CPEs: 55EXPL: 0CVE-2019-9514 – Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
https://notcve.org/view.php?id=CVE-2019-9514
13 Aug 2019 — Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. Algunas implementaciones de HTTP / 2 son vulnerables a una inundación de reinicio, lo que puede conducir a una denegación de servicio. El atacante abre una... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14934
https://notcve.org/view.php?id=CVE-2019-14934
11 Aug 2019 — An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write. Se detectó un problema en PDFResurrect anterior a versión 0.18. La función pdf_load_pages_kids en el archivo pdf.c no comprueba un cierto valor de tamaño, lo que conlleva a un error de malloc y a una escritura fuera de límites. • https://github.com/enferex/pdfresurrect/commit/0c4120fffa3dffe97b95c486a120eded82afe8a6 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 7%CPEs: 4EXPL: 2CVE-2019-14745
https://notcve.org/view.php?id=CVE-2019-14745
07 Aug 2019 — In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables. En radare2 anterior a la versión 3.7.0, se presenta una vulnerabilidad de inyección de comandos en la función bin_symbols() en el archivo libr/core/cbin.c. Mediante el uso de un archivo ejecutable d... • https://github.com/xooxo/CVE-2019-14745 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 1CVE-2019-14744 – kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction
https://notcve.org/view.php?id=CVE-2019-14744
07 Aug 2019 — In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file. En KDE Frameworks KConfig en versiones anteriores a 5.61.0, los archivos de escritorio y los archivos de configuración maliciosos conllevan a la ejecución de código con una interacción mínima del usuario. Es... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-454: External Initialization of Trusted Variables or Data Stores •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14463
https://notcve.org/view.php?id=CVE-2019-14463
31 Jul 2019 — An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301. Se descubrió un problema en LIbmodbus anterior a 3.0.7 y 3.1 x anterior a 3.1.5. hay una lectura fuera de límites para el caso MODBUS_FC_WRITE_MULTIPLE_REGISTERS, también conocido como VD_-1301 • https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14462 – Ubuntu Security Notice USN-5173-1
https://notcve.org/view.php?id=CVE-2019-14462
31 Jul 2019 — An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302. Un problema fue descubierto en LIbmodbus anterior a 3.0.7 y 3.1 x anterior a 3.1.5. hay lectura fuera de límites para el caso MODBUS_FC_WRITE_MULTIPLE_COILS , también conocido como VD-1302 It was discovered that libmodbus incorrectly handled inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. • https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 1CVE-2019-14459 – Gentoo Linux Security Advisory 202003-17
https://notcve.org/view.php?id=CVE-2019-14459
31 Jul 2019 — nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service). nfdump 1.6.17 y versiones anteriores se ven afectadas por un desbordamiento de enteros en la función Process_ipfix_template_withdraw en ipfix.c que se puede abusar para bloquear el proceso de forma remota (denegación de servicio). Multiple vulnerabilities have been found in nfdump, the worst of which could resul... • https://github.com/phaag/nfdump/commit/3b006ededaf351f1723aea6c727c9edd1b1fff9b • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 10%CPEs: 45EXPL: 1CVE-2019-14439 – jackson-databind: Polymorphic typing issue related to logback/JNDI
https://notcve.org/view.php?id=CVE-2019-14439
30 Jul 2019 — A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath. Se detectó un problema de escritura polimórfica en jackson-databind de FasterXML versiones 2.x anteriores a 2.9.9.2. Esto ocurre cuando la Escritura Predeterminada está habilitada (globalmente o para una propiedad específica) para un endp... • https://github.com/jas502n/CVE-2019-14439 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-502: Deserialization of Untrusted Data •