Page 13 of 65 results (0.024 seconds)

CVSS: 4.0EPSS: 0%CPEs: 14EXPL: 0

CVE-2015-3187 – subversion: svn_repos_trace_node_locations() reveals paths hidden by authz

https://notcve.org/view.php?id=CVE-2015-3187

The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Vulnerabilidad en la función svn_repos_trace_node_locations en Apache Subversion en versiones anteriores a 1.7.21 y 1.8.x en versiones anteriores a 1.8.14, cuando se utiliza autorización basada en ruta, permite a usuarios remotos autenticados obtener información de ruta sensible leyendo el historial de un nodo que ha sido movido desde una ruta oculta. It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved). • http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html http://rhn.redhat.com/errata/RHSA-2015-1633.html http://rhn.redhat.com/errata/RHSA-2015-1742.html http://subversion.apache.org/security/CVE-2015-3187-advisory.txt http://www.debian.org/security/2015/dsa-3331 http://www.securityfocus.com/bid/76273 http://www.securitytracker.com/id/1033215 http://www.ubuntu.com/usn/USN-2721-1 https:/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-3027

https://notcve.org/view.php?id=CVE-2015-3027

Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow context-dependent attackers to bypass a stack-guard protection mechanism via crafted input to an affected C program. Clang en LLVM, utilizado en Apple Xcode anterior a 6.3, realiza reservas del registro incorrectas de una forma que provoca almacenaje de pila para punteros de las cookies de la pila, lo que podría permitir a atacantes dependientes de contexto evadir un mecanismo de protección de guard pilas a través de entradas manipuladas en un programa C afectado. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00004.html http://www.securityfocus.com/bid/73987 http://www.securitytracker.com/id/1032081 https://support.apple.com/HT204663 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-1149

https://notcve.org/view.php?id=CVE-2015-1149

Integer overflow in the simulator in Swift in Apple Xcode before 6.3 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact by triggering an incorrect result of a type conversion. Desbordamiento de enteros en el simulador en Swift en Apple Xcode anterior a 6.3 permite a atacantes dependientes de contexto causar una denegación de servicioo posiblemente tener otro impacto no especificado mediante la provocación de un resulto incorrecto de una conversión de tipos. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00004.html http://www.securitytracker.com/id/1032049 https://support.apple.com/HT204663 • CWE-189: Numeric Errors •

CVSS: 9.8EPSS: 94%CPEs: 17EXPL: 1

CVE-2014-9390 – Malicious Git and Mercurial HTTP Server For CVE-2014-9390

https://notcve.org/view.php?id=CVE-2014-9390

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. Git versiones anteriores a 1.8.5.6, versiones 1.9.x anteriores a 1.9.5, versiones 2.0.x anteriores a 2.0.5, versiones 2.1.x anteriores a 2.1.4 y versiones 2.2.x anteriores a 2.2.1 en Windows y OS X; Mercurial versiones anteriores a 3.2.3 en Windows y OS X; Apple Xcode versiones anteriores a 6.2 beta 3; mine todas las versiones antes del 08-12-2014; libgit2 todas las versiones hasta 0.21. 2; Egit todas las versiones anteriores al 08-12-2014; y JGit todas las versiones anteriores al 08-12-2014 permiten a los servidores Git remotos ejecutar comandos arbitrarios por medio de un árbol que contiene un archivo .git/config diseñado con (1) un punto de código Unicode ignorable, (2) una representación git~1/config, o (3) mayúsculas y minúsculas que no son manejadas apropiadamente en un sistema de archivos insensible a mayúsculas y minúsculas • http://article.gmane.org/gmane.linux.kernel/1853266 http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html http://mercurial.selenic.com/wiki/WhatsNew http://securitytracker.com/id?1031404 http://support.apple.com/kb/HT204147 https://github.com/blog/1938-git-client-vulnerability-announced https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 https://libgit2.org/security https://news.ycombinator.com/item?id=8769667 https://www.rapid7.com/blo • CWE-20: Improper Input Validation •

CVSS: 5.0EPSS: 0%CPEs: 27EXPL: 0

CVE-2012-3698

https://notcve.org/view.php?id=CVE-2012-3698

Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool. Apple Xcode antes de v4.4 no compone adecuadamente una solicitud designada (DR) durante la firma de programas que no cuenta con identificadores de paquetes, lo que permite a atacantes remotos leer las entradas de la keychain a través de una aplicación hecha para tal fin, tal y como se demuestra con las entradas de keychain de (1) una herramienta de ayuda o (2) de la línea de comandos. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •