CVSS: 7.5EPSS: 1%CPEs: 20EXPL: 0CVE-2019-3816 – openwsman: Disclosure of arbitrary files outside of the registered URIs
https://notcve.org/view.php?id=CVE-2019-3816
14 Mar 2019 — Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server. Openwsman, en versiones hasta e incluyendo la 2.6.9, es vulnerable a una divulgación de archivos arbitrarios debido a que el directorio de trabajo del demonio openwsmand se establecía en el directorio root. Un at... • http://bugzilla.suse.com/show_bug.cgi?id=1122623 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2019-9628 – Ubuntu Security Notice USN-3921-1
https://notcve.org/view.php?id=CVE-2019-9628
12 Mar 2019 — The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type. La libreria XMLTooling, en todas las versiones anteriores a la V3.0.4, suministrada con el software OpenSAML y Shibboleth Service Provider, contiene una clase de parser XML. Los datos no válidos en ... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 4.4EPSS: 0%CPEs: 7EXPL: 1CVE-2019-8905
https://notcve.org/view.php?id=CVE-2019-8905
18 Feb 2019 — do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. do_core_note en readelf.c en libmagic.a en la versión 5.35 de file tiene una sobrelectura de búfer basada en pila relacionada con file_printable. Esta vulnerabilidad es diferente de CVE-2018-10360. • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html • CWE-125: Out-of-bounds Read •
CVSS: 4.4EPSS: 0%CPEs: 10EXPL: 1CVE-2019-8906 – Slackware Security Advisory - file Updates
https://notcve.org/view.php?id=CVE-2019-8906
18 Feb 2019 — do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. do_core_note en readelf.c en libmagic.a en la versión 5.35 de file tiene una lectura fuera de límites debido a una mala utilización de memcpy. New file packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 1CVE-2019-8907 – Slackware Security Advisory - file Updates
https://notcve.org/view.php?id=CVE-2019-8907
18 Feb 2019 — do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. do_core_note en readelf.c en libmagic.a en la versión 5.35 de file permite a los atacantes remotos provocar una denegación de servicio (corrupción de pila y cierre inesperado de la aplicación) o cualquier otro impacto no especificado. New file packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix sec... • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html • CWE-787: Out-of-bounds Write •
CVSS: 7.0EPSS: 0%CPEs: 55EXPL: 1CVE-2019-6454 – systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash
https://notcve.org/view.php?id=CVE-2019-6454
18 Feb 2019 — An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic). Se ha descubierto un problema en sd-bus en... • http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00070.html • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 19EXPL: 2CVE-2019-7665 – elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c
https://notcve.org/view.php?id=CVE-2019-7665
09 Feb 2019 — In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes. En elfutils 0.175, existe una sobrelectura de búfer basada en memoria dinámica (heap) en la función elf32_xlatetom en elf32_xlatetom.c. Una entrada ELF manipulada puede provocar un fallo de segmentación que conduce a una dene... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html • CWE-122: Heap-based Buffer Overflow CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 19EXPL: 1CVE-2019-7150 – elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c
https://notcve.org/view.php?id=CVE-2019-7150
29 Jan 2019 — An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack. Se ha descubierto un problema en la versión 0.175 de elfutils. Podría ocurrir un fallo de segmentación en la función elf64_xlatetom en libelf/elf32_xlatetom.c, debido a que ... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 2CVE-2018-20545
https://notcve.org/view.php?id=CVE-2018-20545
28 Dec 2018 — There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data. Hay un acceso de ESCRITURA de memoria ilegal en common-image.c (en la función load_image) en los datos 4bpp de la versión 0.99.beta19 de libcaca. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00033.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 1CVE-2018-20546
https://notcve.org/view.php?id=CVE-2018-20546
28 Dec 2018 — There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case. Hay un acceso de LECTURA ilegal en la memoria en caca/dither.c (función get_rgba_default) en libcaca 0.99.beta19 para el caso bpp por defecto. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00033.html • CWE-190: Integer Overflow or Wraparound •