CVSS: 9.8EPSS: 2%CPEs: 260EXPL: 0CVE-2019-5544 – VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-5544
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. OpenSLP, como es usado en ESXi y los dispositivos Horizon DaaS, presenta un problema de sobrescritura de la pila. VMware ha evaluado la gravedad de este problema para estar en el rango de gravedad Crítica con una puntuación base máxima CVSSv3 de 9.8. A heap overflow vulnerability was found in OpenSLP. • http://www.openwall.com/lists/oss-security/2019/12/10/2 http://www.openwall.com/lists/oss-security/2019/12/11/2 http://www.vmware.com/security/advisories/VMSA-2019-0022.html https://access.redhat.com/errata/RHSA-2019:4240 https://access.redhat.com/errata/RHSA-2020:0199 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA3LYAJ2NRKMOZLZOQNDJ5TNQRFMWGHF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPXXJZLPLAQU • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 17EXPL: 0CVE-2019-19334 – libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used
https://notcve.org/view.php?id=CVE-2019-19334
In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. En todas las versiones de libyang anteriores a 1.0-r5, se detectó un desbordamiento del búfer en la región heap de la memoria en la manera en que libyang analiza los archivos YANG con una hoja de tipo "identityref". Una aplicación que usa libyang para analizar archivos YANG no confiables puede ser vulnerable a este fallo, lo que permitiría a un atacante causar una denegación de servicio o posiblemente conseguir la ejecución de código. A stack-based buffer overflow flaw was discovered in the way libyang parses YANG files with a leaf of type "identityref". • https://access.redhat.com/errata/RHSA-2019:4360 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19334 https://github.com/CESNET/libyang/commit/6980afae2ff9fcd6d67508b0a3f694d75fd059d6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PETB6TVMFV5KUD4IKVP2JPLBCYHUGSAJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RL54JMS7XW7PI6JC4BFSNNLSX5AINQUL https://access.redhat.com/security/cve/CVE-2019-19334 https://bugzilla.redhat.com/show_bug.c • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 18EXPL: 0CVE-2019-1551 – rsaz_512_sqr overflow bug on x86_64
https://notcve.org/view.php?id=CVE-2019-1551
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=419102400a2811582a7a3d4a4e317d72e5ce0a8f https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f1c5eea8a817075d31e43f5876993c6710238c98 https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag • CWE-190: Integer Overflow or Wraparound •
CVSS: 2.6EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1002102 – Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints
https://notcve.org/view.php?id=CVE-2018-1002102
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet. Una comprobación inapropiada de un redireccionamiento de URL en el servidor Kubernetes API en versiones anteriores a v1.14.0, permite que un Kubelet controlado por el atacante redireccione las peticiones del servidor API desde endpoints de transmisión hacia hosts arbitrarios. Los servidores API impactados seguirán el redireccionamiento como una petición GET con credenciales de certificado del cliente para autenticarse en el Kubelet. • https://github.com/kubernetes/kubernetes/issues/85867 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q56CULSH7F7BC4NPS67ZS23ZCLL5TIVK https://access.redhat.com/security/cve/CVE-2018-1002102 https://bugzilla.redhat.com/show_bug.cgi?id=1784602 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19118
https://notcve.org/view.php?id=CVE-2019-19118
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.) Django versiones 2.1 anteriores a 2.1.15 y versiones 2.2 anteriores a 2.2.8, permite una edición de modelos involuntaria. • http://www.openwall.com/lists/oss-security/2019/12/02/1 https://docs.djangoproject.com/en/dev/releases/security https://groups.google.com/forum/#%21topic/django-announce/GjGqDvtNmWQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5 https://security.gentoo.org/glsa/202004-17 https://security.netapp.com/advisory/ntap-20191217-0003 https://www.djangoproject.com/weblog/2019/dec/02/security-releases • CWE-276: Incorrect Default Permissions •