Page 132 of 2118 results (0.024 seconds)

CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 1

CVE-2018-1000069

https://notcve.org/view.php?id=CVE-2018-1000069

FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from victim's machine. This attack appears to require the victim to open a specially crafted mind map file. This vulnerability appears to have been fixed in 1.6+. FreePlane, en su versión 1.5.9 y anteriores, contiene una vulnerabilidad de XEE (XML External Entity) en el analizador XML en el cargador mindmap que puede dar como resultado el robo de datos de la máquina de la víctima. Parece que este ataque requiere que la víctima abra un archivo mindmap especialmente manipulado. • https://lists.debian.org/debian-lts-announce/2018/03/msg00019.html https://www.debian.org/security/2018/dsa-4175 https://www.freeplane.org/wiki/index.php/XML_External_Entity_vulnerability_in_map_parser https://www.youtube.com/watch?v=7IXtiTNilAI • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0

CVE-2018-1000077 – rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL

https://notcve.org/view.php?id=CVE-2018-1000077

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de validación de entradas incorrecta en el atributo specification homepage de ruby gems que puede resultar en que una gema maliciosa podría establecer una URL de página de inicio no válida. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6. • http://blog.rubygems.org/2018/02/15/2.7.6-released.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html https://access.redhat.com/errata/RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2019:2028 https://access.redhat.com/errata/RHSA-2020:0542 https://access.redhat.com/errata/RHSA-2020:0591 https://access.redhat.com/errata/RHSA-2020:0663 https& • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0

CVE-2018-1000075 – rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

https://notcve.org/view.php?id=CVE-2018-1000075

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene un bucle infinito provocado por una vulnerabilidad de tamaño negativo en la cabecera tar del paquete de ruby gem que puede resultar en un tamaño negativo que desemboque en un bucle infinito. La vulnerabilidad parece haber sido solucionada en la versión 2.7.6. • http://blog.rubygems.org/2018/02/15/2.7.6-released.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html https://access.redhat.com/errata/RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2019:2028 https://access.redhat.com/errata/RHSA-2020:0542 https://access.redhat.com/errata/RHSA-2020:0591 https://access.redhat.com/errata/RHSA-2020:0663 https& • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •

CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0

CVE-2018-1000078 – rubygems: XSS vulnerability in homepage attribute when displayed via gem server

https://notcve.org/view.php?id=CVE-2018-1000078

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. Las versiones de RubyGems de la serie Ruby 2.2: 2.2.9 y anteriores, de la serie Ruby 2.3: 2.3.6 y anteriores, de la serie Ruby 2.4: 2.4.3 y anteriores, y de la serie Ruby 2.5: versiones 2.5.0 y anteriores, anteriores a la revisión del trunk 62422 contiene una vulnerabilidad de Cross-Site Scripting (XSS) en la visualización del servidor gem del atributo homepage que podría resultar en XSS. El ataque parece ser explotable mediante una víctima que navegue hasta una gema maliciosa en un servidor gem vulnerable. • http://blog.rubygems.org/2018/02/15/2.7.6-released.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html https://access.redhat.com/errata/RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2019:2028 https://access.redhat.com/errata/RHSA-2020:0542 https://access.redhat.com/errata/RHSA-2020:0591 https://access.redhat.com/errata/RHSA-2020:0663 https& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1

CVE-2018-7998

https://notcve.org/view.php?id=CVE-2018-7998

In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads. En libvips, en versiones anteriores a la 8.6.3, se ha encontrado una vulnerabilidad de desreferencia de puntero de función NULL en la función rvips_region_generate en region.c. Esto permite que atacantes remotos provoquen una denegación de servicio (DoS) u otro tipo de impacto sin especificar mediante un archivo de imagen manipulado. Esto ocurre debido a una condición de carrera relacionada con una carga aplazada fallida y otros subprocesos de trabajo. • https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5 https://github.com/jcupitt/libvips/issues/893 https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-476: NULL Pointer Dereference •