CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-48234 – overflow in nv_z_get_count in vim
https://notcve.org/view.php?id=CVE-2023-48234
16 Nov 2023 — Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. • http://www.openwall.com/lists/oss-security/2023/11/16/1 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-48235 – overflow in ex address parsing in vim
https://notcve.org/view.php?id=CVE-2023-48235
16 Nov 2023 — Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. • http://www.openwall.com/lists/oss-security/2023/11/16/1 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-48236 – overflow in get_number in vim
https://notcve.org/view.php?id=CVE-2023-48236
16 Nov 2023 — Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. • http://www.openwall.com/lists/oss-security/2023/11/16/1 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-48237 – overflow in shift_line in vim
https://notcve.org/view.php?id=CVE-2023-48237
16 Nov 2023 — Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. • http://www.openwall.com/lists/oss-security/2023/11/16/1 • CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 1CVE-2023-6112 – Gentoo Linux Security Advisory 202311-11
https://notcve.org/view.php?id=CVE-2023-6112
15 Nov 2023 — Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Use after free en Navegación en Google Chrome anterior a 119.0.6045.159 permitía a un atacante remoto explotar potencialmente la corrupción del heap a través de una página HTML manipulada. (Severidad de seguridad de Chrome: alta) Multiple vulnerabilities have been discovered in Chromium and its derivatives, the wors... • https://packetstorm.news/files/id/176721 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 0CVE-2023-5997 – Gentoo Linux Security Advisory 202311-11
https://notcve.org/view.php?id=CVE-2023-5997
15 Nov 2023 — Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Use after free en Garbage Collection en Google Chrome anterior a 119.0.6045.159 permitía a un atacante remoto explotar potencialmente la corrupción del heap a través de una página HTML manipulada. (Severidad de seguridad de Chrome: alta) Multiple vulnerabilities have been discovered in Chromium and its deriv... • https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html • CWE-416: Use After Free •
CVSS: 9.0EPSS: 29%CPEs: 7EXPL: 0CVE-2023-5528 – Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-5528
14 Nov 2023 — A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods y volúmenes persistentes en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ... • https://github.com/kubernetes/kubernetes/issues/121879 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 5%CPEs: 5EXPL: 0CVE-2023-46850 – Ubuntu Security Notice USN-6484-1
https://notcve.org/view.php?id=CVE-2023-46850
11 Nov 2023 — Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. Use after free en OpenVPN versión 2.6.0 a 2.6.6 puede provocar un comportamiento indefinido, pérdida de búferes de memoria o ejecución remota al enviar búferes de red a un par remoto. It was discovered that OpenVPN incorrectly handled the --fragment option in certain configurations. A remote attacker could possibly use this issue to cause ... • https://community.openvpn.net/openvpn/wiki/CVE-2023-46850 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2023-46849 – Ubuntu Security Notice USN-6484-1
https://notcve.org/view.php?id=CVE-2023-46849
11 Nov 2023 — Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. El uso de la opción --fragment en ciertas configuraciones de OpenVPN versión 2.6.0 a 2.6.6 permite a un atacante desencadenar un comportamiento de división por cero que podría provocar un bloqueo de la aplicación y provocar una denegación de servicio. It was discovered that OpenVPN incorrect... • https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 • CWE-369: Divide By Zero •
CVSS: 6.4EPSS: 0%CPEs: 9EXPL: 0CVE-2023-5547 – Moodle: xss risk when previewing data in course upload tool
https://notcve.org/view.php?id=CVE-2023-5547
09 Nov 2023 — The course upload preview contained an XSS risk for users uploading unsafe data. La vista previa de la carga del curso contenía un riesgo XSS para los usuarios que cargaban datos no seguros. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79455 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •