CVSS: 5.9EPSS: 0%CPEs: 47EXPL: 0CVE-2018-0735 – Timing attack against ECDSA signature generation
https://notcve.org/view.php?id=CVE-2018-0735
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Se ha demostrado que el algoritmo de firmas ECDSA en OpenSSL es vulnerable a un ataque de sincronización de canal lateral. • http://www.securityfocus.com/bid/105750 http://www.securitytracker.com/id/1041986 https://access.redhat.com/errata/RHSA-2019:3700 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4 https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html https://nodejs.org/en/blog/vulnerability/november-2018-security-releases https://security.netapp.com/advisor • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-385: Covert Timing Channel •
CVSS: 9.3EPSS: 97%CPEs: 13EXPL: 13CVE-2018-11776 – Apache Struts Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. Apache Struts, desde la versión 2.3 hasta la 2.3.34 y desde la versión 2.5 hasta la 2.5.16, sufre de una posible ejecución remota de código cuando el valor de alwaysSelectFullNamespace es "true" (establecido por el usuario o por un plugin como Convention Plugin). Además, los resultados se emplean sin ningún espacio de nombres y, al mismo tiempo, el paquete superior no tiene espacio de nombres o contiene caracteres comodín. De manera similar a como pasa con los resultados, existe la misma posibilidad al emplear la etiqueta url, que no tiene un valor y acción definidos y, además, su paquete superior no tiene espacio de nombres o contiene caracteres comodín. Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. • https://www.exploit-db.com/exploits/45260 https://www.exploit-db.com/exploits/45367 https://www.exploit-db.com/exploits/45262 https://github.com/hook-s3c/CVE-2018-11776-Python-PoC https://github.com/xfox64x/CVE-2018-11776 https://github.com/bhdresh/CVE-2018-11776 https://github.com/jiguangsdf/CVE-2018-11776 https://github.com/brianwrf/S2-057-CVE-2018-11776 https://github.com/knqyf263/CVE-2018-11776 https://github.com/cucadili/CVE-2018-11776 https://github.co •
CVSS: 7.4EPSS: 0%CPEs: 14EXPL: 0CVE-2018-1656 – JDK: path traversal flaw in the Diagnostic Tooling Framework
https://notcve.org/view.php?id=CVE-2018-1656
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882. Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0, 7.0 y 8.0) de IBM Java Runtime Environment no protege contra ataques de salto de directorio cuando se extraen archivos de volcado comprimidos. IBM X-Force ID: 144882. • http://www.ibm.com/support/docview.wss?uid=ibm10719653 http://www.securityfocus.com/bid/105118 http://www.securitytracker.com/id/1041765 https://access.redhat.com/errata/RHSA-2018:2568 https://access.redhat.com/errata/RHSA-2018:2569 https://access.redhat.com/errata/RHSA-2018:2575 https://access.redhat.com/errata/RHSA-2018:2576 https://access.redhat.com/errata/RHSA-2018:2712 https://access.redhat.com/errata/RHSA-2018:2713 https://exchange.xforce.ibmcloud.com/vulnerabilities/14 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-12539 – JDK: privilege escalation via insufficiently restricted access to Attach API
https://notcve.org/view.php?id=CVE-2018-12539
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option -Dcom.ibm.tools.attach.enable=no. En Eclipse OpenJ9 0.8, otros usuarios diferentes al propietario del proceso podrían emplear la API Java Attach para conectarse a Eclipse OpenJ9 o IBM JVM en el mismo equipo y emplear operaciones Attach API, que incluyen la capacidad de ejecutar código nativo no fiable. Attach API está habilitado por defecto en Windows, Linux y AIX JVM y puede deshabilitarse mediante la opción de línea de comandos -Dcom.ibm.tools.attach.enable=no. • http://www.securityfocus.com/bid/105126 http://www.securitytracker.com/id/1041765 https://access.redhat.com/errata/RHSA-2018:2568 https://access.redhat.com/errata/RHSA-2018:2569 https://access.redhat.com/errata/RHSA-2018:2575 https://access.redhat.com/errata/RHSA-2018:2576 https://access.redhat.com/errata/RHSA-2018:2712 https://access.redhat.com/errata/RHSA-2018:2713 https://bugs.eclipse.org/bugs/show_bug.cgi?id=534589 https://www.oracle.com/technetwork/security-advisory& • CWE-287: Improper Authentication CWE-419: Unprotected Primary Channel CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 76EXPL: 1CVE-2018-8032
https://notcve.org/view.php?id=CVE-2018-8032
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. Apache Axis en versiones 1.x hasta la 1.4 (incluida) es vulnerable a un ataque de Cross-Site Scripting (XSS) en el servlet/services por defecto. • https://github.com/cairuojin/CVE-2018-8032 http://mail-archives.apache.org/mod_mbox/axis-java-dev/201807.mbox/%3CJIRA.13170716.1531060536000.93536.1531060560060%40Atlassian.JIRA%3E https://issues.apache.org/jira/browse/AXIS-2924 https://lists.apache.org/thread.html/3b89bc9e9d055db7eba8835ff6501f3f5db99d2a0928ec0be9b1d17b%40%3Cjava-dev.axis.apache.org%3E https://lists.apache.org/thread.html/d06ed5e4eeb77d00e8d594ec01ee8ee1cba173a01ac4b18f1579d041%40%3Cjava-dev.axis.apache.org%3E https://lists.debian.org/debian-lts-announce/2021/11& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •