CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 4CVE-2011-5325 – WAGO 852 Industrial Managed Switch Series Code Execution / Hardcoded Credentials
https://notcve.org/view.php?id=CVE-2011-5325
07 Aug 2017 — Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink. Una vulnerabilidad de salto de directorio en la implementación de tar en BusyBox en versiones anteriores a 1.22.0 v5 permite que atacantes remotos apunten a archivos situados fuera del actual directorio de trabajo a través de un symlink. The industrial managed switch series 852 from WAGO is affected by multiple vulnerabilities ... • http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-11683
https://notcve.org/view.php?id=CVE-2017-11683
27 Jul 2017 — There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. Hay una aserción alcanzable en la función Internal::TiffReader::visitDirectory en el archivo tiffvisitor.cpp de Exiv2 versión 0.26 que conllevará a un ataque de denegación de servicio remoto por medio de una entrada creada. • http://www.securityfocus.com/bid/100030 • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2017-11591
https://notcve.org/view.php?id=CVE-2017-11591
24 Jul 2017 — There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. Hay una excepción de punto flotante en la función Exiv2::ValueType en Exiv2 versión 0.26 que conllevará a un ataque de denegación de servicio remoto por medio de una entrada creada. • https://bugzilla.redhat.com/show_bug.cgi?id=1473888 •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-9239
https://notcve.org/view.php?id=CVE-2017-9239
26 May 2017 — An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file. Se ha detectado un problema en Exiv2 versión 0.26. • http://dev.exiv2.org/issues/1295 • CWE-369: Divide By Zero •
CVSS: 9.8EPSS: 1%CPEs: 16EXPL: 0CVE-2017-7481 – ansible: Security issue with lookup return not tainting the jinja2 environment
https://notcve.org/view.php?id=CVE-2017-7481
18 May 2017 — Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated. Ansible en versiones anteriores a la 2.3.1.0 y 2.4.0.0 no marca correctamente los resultados del plugin lookup como no seguros. Si un atacante pudiese c... • http://www.securityfocus.com/bid/98492 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 2%CPEs: 7EXPL: 1CVE-2017-6519 – avahi: Multicast DNS responds to unicast queries outside of local network
https://notcve.org/view.php?id=CVE-2017-6519
01 May 2017 — avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. avahi-daemon en Avahi, hasta las versiones 0.6.32 y 0.7, responde a consultas IPv6 unicast arbitrarias de manera inadver... • https://bugzilla.redhat.com/show_bug.cgi?id=1426712 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-346: Origin Validation Error •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0CVE-2016-3616 – libjpeg: null pointer dereference in cjpeg
https://notcve.org/view.php?id=CVE-2016-3616
13 Feb 2017 — The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file. La utilidad cjpeg en libjpeg permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída de aplicación) o ejecutar código arbitrario a través de un archivo manipulado. • https://access.redhat.com/errata/RHSA-2019:2052 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 1%CPEs: 14EXPL: 0CVE-2016-5824 – libical: Multiple use-after-free vulnerabilities
https://notcve.org/view.php?id=CVE-2016-5824
27 Jan 2017 — libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. libical 1.0 permite a atacantes remotos provocar una denegación de servicio (uso después de liberación de memoria) a través de un archivo ics manipulado. • http://www.openwall.com/lists/oss-security/2016/06/25/4 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 3%CPEs: 7EXPL: 7CVE-2016-2148 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-2148
05 Dec 2016 — Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. Desbordamiento de búfer basado en memoria dinámica en el cliente DHCP (udhcpc) en BusyBox en versiones anteriores a 1.25.0 permite a atacantes remotos tener un impacto no especificado a través de vectores que implican el análisis de OPTION_6RD. Many Cisco devices such as Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P, Cisco RV260, ... • http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 7%CPEs: 7EXPL: 7CVE-2016-2147 – Cisco Device Hardcoded Credentials / GNU glibc / BusyBox
https://notcve.org/view.php?id=CVE-2016-2147
05 Dec 2016 — Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write. Desbordamiento de entero en el cliente DHCP (udhcpc) en BusyBox en versiones anteriores a 1.25.0 permite a atacantes remotos provocar una denegación de servicio (caída) a través de un nombre de dominio codificado RFC1035 mal formado, lo que desencadena una escritura de memoria dinámica fuera... • http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html • CWE-190: Integer Overflow or Wraparound •