CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 2CVE-2018-8763 – LDAP Account Manager 6.2 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-8763
Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form URI. Roland Gruber Softwareentwicklung LDAP Account Manager, en versiones anteriores a la 6.3, contiene Cross-Site Scripting (XSS) mediante el parámetro dn en el URI templates/3rdParty/pla/htdocs/cmd.php o el parámetro template en el URI templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form. LDAP Account Manager version 6.2 suffers from cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/146858/LDAP-Account-Manager-6.2-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2018/Mar/45 https://lists.debian.org/debian-lts-announce/2018/04/msg00007.html https://www.debian.org/security/2018/dsa-4165 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 22EXPL: 0CVE-2018-8822
https://notcve.org/view.php?id=CVE-2018-8822
Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code. Manipulación incorrecta de longitud de búfer en la función ncp_read_kernel en fs/ncpfs/ncplib_kernel.c en el kernel de Linux hasta la versión 4.15.11 y en drivers/staging/ncpfs/ncplib_kernel.c en el kernel de Linux 4.16-rc hasta 4.16-rc6 podría ser explotada por servidores NCPFS maliciosos para cerrar inesperadamente el kernel o ejecutar código. • http://www.openwall.com/lists/oss-security/2022/12/27/3 http://www.securityfocus.com/bid/103476 https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html https://usn.ubuntu.com/3653-1 https://usn.ubuntu.com/3653-2 https://usn.ubuntu.com/3654-1 https://usn.ubuntu.com/3654-2 https://usn.ubuntu.com/3655-1 https://usn.ubuntu.com/3655-2 https://usn.ubuntu.com/3656-1 https://usn.ubuntu.com/3657-1 https://www.debian.org/security/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-8741
https://notcve.org/view.php?id=CVE-2018-8741
A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php. Un error de salto de directorio en SquirrelMail 1.4.22 permite que un atacante autenticado exfiltre (o elimine) archivos del servidor que los aloja. Esto está relacionado con ../ en el campo att_local_name en Deliver.class.php. • http://www.openwall.com/lists/oss-security/2018/03/17/2 http://www.securitytracker.com/id/1040554 https://gist.github.com/hannob/3c4f86863c418930ad08853c1109364e https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18 https://lists.debian.org/debian-lts-announce/2018/04/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5FP • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5147
https://notcve.org/view.php?id=CVE-2018-5147
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1. La librería libtremor tiene el mismo fallo que CVE-2018-5146. Esta librería es usada por Firefox en lugar de libvorbis en plataformas Android y ARM. • http://www.securityfocus.com/bid/103432 http://www.securitytracker.com/id/1040544 https://bugzilla.mozilla.org/show_bug.cgi?id=1446365 https://lists.debian.org/debian-lts-announce/2018/03/msg00016.html https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html https://www.debian.org/security/2018/dsa-4141 https://www.debian.org/security/2018/dsa-4143 https://www.mozilla.org/security/advisories/mfsa2018-08 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 35%CPEs: 22EXPL: 1CVE-2018-5146 – Mozilla Firefox libvorbis OGG Decoding Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-5146
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7. Una escritura de memoria fuera de límites mientras se procesaban los datos de audio de Vorbis fue reportada a través de la competición Pwn2Own. Esta vulnerabilidad afecta a las versiones anteriores a la 59.0.1 de Firefox, las versiones anteriores a la 52.7.2 de Firefox ESR y las versiones anteriores a la 52.7 de Thunderbird. An out of bounds write flaw was found in the processing of vorbis audio data. • https://github.com/f01965/CVE-2018-5146 http://www.securityfocus.com/bid/103432 http://www.securitytracker.com/id/1040544 https://access.redhat.com/errata/RHSA-2018:0549 https://access.redhat.com/errata/RHSA-2018:0647 https://access.redhat.com/errata/RHSA-2018:0648 https://access.redhat.com/errata/RHSA-2018:0649 https://access.redhat.com/errata/RHSA-2018:1058 https://bugzilla.mozilla.org/show_bug.cgi?id=1446062 https://lists.debian.org/debian-lts-announce/2018/03/msg • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •