CVSS: 8.1EPSS: 1%CPEs: 32EXPL: 1CVE-2019-2698 – Oracle Java Runtime Environment - Heap Corruption During TTF font Rendering in GlyphIterator::setCurrGlyphID
https://notcve.org/view.php?id=CVE-2019-2698
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. • https://www.exploit-db.com/exploits/46723 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html https://access.redhat.com/errata/RHBA-2019:0959 https://access.redhat.com/errata/RHSA-2019:1146 https://access.redhat.com/errata/RHSA-2019:1163 https:/& • CWE-787: Out-of-bounds Write •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1003050
https://notcve.org/view.php?id=CVE-2019-1003050
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names. El control de formulario f: validateButton para la interfaz de usuario de Jenkins no escapa apropiadamente de las URL de tareas en Jenkins versión 2.171 y anteriores y Jenkins LTS versión 2.164.1 y anteriores, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) explotable por los usuarios con la capacidad de controlar los nombre de tarea. • http://www.securityfocus.com/bid/107889 https://access.redhat.com/errata/RHBA-2019:1605 https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327 https://www.oracle.com/security-alerts/cpuapr2022.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-1003049
https://notcve.org/view.php?id=CVE-2019-1003049
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches. Los usuarios que almacenaron su autenticación CLI antes de que Jenkins se actualizara a la versión 2.150.2 o posteriores, o a la versión 2.160 o posteriores, permanecerían autenticados en Jenkins 2.171 y anteriores y en Jenkins LTS 2.164.1 y anteriores, ya que la solución para CVE-2019-1003004 en estas versiones no rechazaba las cachés de autenticación CLI remotas existentes. • http://www.securityfocus.com/bid/107901 https://access.redhat.com/errata/RHBA-2019:1605 https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1289 https://www.oracle.com/security-alerts/cpuapr2022.html • CWE-613: Insufficient Session Expiration •
CVSS: 8.8EPSS: 96%CPEs: 68EXPL: 3CVE-2019-0211 – Apache HTTP Server Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2019-0211
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected. En Apache HTTP Server 2.4, versiones 2.4.17 a 2.4.38, con el evento MPM, worker o prefork, el código ejecutándose en procesos hijo (o hilos) menos privilegiados (incluyendo scripts ejecutados por un intérprete de scripts en proceso) podría ejecutar código arbitrario con los privilegios del proceso padre (normalmente root) manipulando el marcador. Los sistemas que no son Unix no se ven afectados. A flaw was found in Apache where code executing in a less-privileged child process or thread could execute arbitrary code with the privilege of the parent process (usually root). • https://www.exploit-db.com/exploits/46676 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x • CWE-250: Execution with Unnecessary Privileges CWE-416: Use After Free •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 1CVE-2019-1002101 – kubectl cp path traversal
https://notcve.org/view.php?id=CVE-2019-1002101
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. • https://github.com/brompwnie/CVE-2019-1002101-Helpers http://www.openwall.com/lists/oss-security/2019/06/21/1 http://www.openwall.com/lists/oss-security/2019/08/05/5 http://www.securityfocus.com/bid/107652 https://access.redhat.com/errata/RHBA-2019:0619 https://access.redhat.com/errata/RHBA-2019:0620 https://access.redhat.com/errata/RHBA-2019:0636 https://access.redhat.com/security/cve/cve-2019-1002101 https://github.com/kubernetes/kubernetes/pull/75037 https:/&#x • CWE-59: Improper Link Resolution Before File Access ('Link Following') •