CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2019-19917
https://notcve.org/view.php?id=CVE-2019-19917
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c. Lout versión 3.40, presenta un desbordamiento de búfer en la función StringQuotedWord() en el archivo z39.c. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00069.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OXECUBSXEO7S3TCLSBCITLQIMOCL6MV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEJVEIQMRXJ26ZT • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2019-19918
https://notcve.org/view.php?id=CVE-2019-19918
Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c. Lout versión 3.40, presenta un desbordamiento de búfer en la región heap de la memoria en la función srcnext() en el archivo z02.c. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00068.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00069.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OXECUBSXEO7S3TCLSBCITLQIMOCL6MV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEJVEIQMRXJ26ZT • CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16782 – Possible Information Leak / Session Hijack Vulnerability in Rack
https://notcve.org/view.php?id=CVE-2019-16782
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html http://www.openwall.com/lists/oss-security/2019/12/18/2 http://www.openwall.com/lists/oss-security/2019/12/18/3 http://www.openwall.com/lists/oss-security/2019/12/19/3 http://www.openwall.com/lists/oss-security/2020/04/08/1 http://www.openwall.com/lists/oss-security/2020/04/09/2 https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38 https://github.com/rack/rack/securit • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy CWE-208: Observable Timing Discrepancy •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16779 – In RubyGem excon, interrupted Persistent Connections May Leak Response Data
https://notcve.org/view.php?id=CVE-2019-16779
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this. En RubyGem excon versiones anteriores a 0.71.0, se presentó una condición de carrera alrededor de conexiones persistentes, donde una conexión que es interrumpida (tal y como, mediante un tiempo de espera) dejaría datos en el socket. Las peticiones posteriores entonces leerían estos datos y devolverían el contenido de la respuesta anterior. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29 https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-664: Improper Control of a Resource Through its Lifetime •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2014-2387
https://notcve.org/view.php?id=CVE-2014-2387
Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities Pen versión 0.18.0, presenta vulnerabilidades no seguras en la creación de archivos temporales. • http://www.openwall.com/lists/oss-security/2014/03/13/5 http://www.openwall.com/lists/oss-security/2014/03/14/2 http://www.securityfocus.com/bid/66214 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-2387 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-2387 https://exchange.xforce.ibmcloud.com/vulnerabilities/91992 https://security-tracker.debian.org/tracker/CVE-2014-2387 • CWE-668: Exposure of Resource to Wrong Sphere •