CVSS: 7.8EPSS: 0%CPEs: 36EXPL: 0CVE-2024-1547 – Mozilla: Alert dialog could have been spoofed on another site
https://notcve.org/view.php?id=CVE-2024-1547
20 Feb 2024 — Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. A través de una serie de llamadas API y redireccionamientos, se podría haber mostrado un cuadro de diálogo de alerta controlado por el atacante en otro sitio web (con la URL del sitio web de la víctima mostrada). Esta vulnerabilidad afecta a Firefox < 123,... • https://bugzilla.mozilla.org/show_bug.cgi?id=1877879 • CWE-449: The UI Performs the Wrong Action •
CVSS: 7.6EPSS: 0%CPEs: 36EXPL: 0CVE-2024-1546 – Mozilla: Out-of-bounds memory read in networking channels
https://notcve.org/view.php?id=CVE-2024-1546
20 Feb 2024 — When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Al almacenar y volver a acceder a datos en un canal de red, es posible que se haya confundido la longitud de los bufferse, lo que resulta en una lectura de memoria fuera de los límites. Esta vulnerabilidad afecta a Firefox < 123, Firefox ESR < 115.8 y Thunderbird < ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1843752 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-36774
https://notcve.org/view.php?id=CVE-2020-36774
19 Feb 2024 — plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). plugins/gtk+/glade-gtk-box.c en GNOME Glade anterior a 3.38.1 y 3.39.x anterior a 3.40.0 maneja mal la reconstrucción de widgets para GladeGtkBox, lo que provoca una denegación de servicio (caída de la aplicación). • https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17 • CWE-664: Improper Control of a Resource Through its Lifetime •
CVSS: 10.0EPSS: 0%CPEs: 25EXPL: 0CVE-2022-48624 – less: missing quoting of shell metacharacters in LESSCLOSE handling
https://notcve.org/view.php?id=CVE-2022-48624
19 Feb 2024 — close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. close_altfile en filename.c en less antes de 606 omite las llamadas shell_quote para LESSCLOSE. A flaw was found in less. The close_altfile() function in filename.c omits shell_quote calls for LESSCLOSE, a command line to invoke the optional input postprocessor. This issue could lead to an OS command injection vulnerability and arbitrary command execution on the host operating system. • https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2024-20925
https://notcve.org/view.php?id=CVE-2024-20925
17 Feb 2024 — Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attac... • https://www.oracle.com/security-alerts/cpujan2024.html •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2024-20923
https://notcve.org/view.php?id=CVE-2024-20923
17 Feb 2024 — Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attac... • https://www.oracle.com/security-alerts/cpujan2024.html •
CVSS: 8.0EPSS: 0%CPEs: 20EXPL: 0CVE-2024-1488 – Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation
https://notcve.org/view.php?id=CVE-2024-1488
15 Feb 2024 — A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. Se encontr... • https://access.redhat.com/errata/RHSA-2024:1750 • CWE-15: External Control of System or Configuration Setting •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 1CVE-2023-50868 – bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
https://notcve.org/view.php?id=CVE-2023-50868
13 Feb 2024 — The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. El aspecto Closest Encloser Proof del protocolo DNS (en RFC 5155 cuando se omite la guía RFC 9276) permite a a... • https://github.com/Goethe-Universitat-Cybersecurity/NSEC3-Encloser-Attack • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48623
https://notcve.org/view.php?id=CVE-2022-48623
13 Feb 2024 — The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service. El paquete Cpanel::JSON::XS anterior a 4.33 para Perl realiza accesos fuera de los límites de una manera que permite a los atacantes obtener información confidencial o provocar una denegación de servicio. • https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Cpanel-JSON-XS.yml#L25-L36 • CWE-125: Out-of-bounds Read •
CVSS: 3.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1454 – Opensc: memory use after free in authentic driver when updating token info
https://notcve.org/view.php?id=CVE-2024-1454
12 Feb 2024 — The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during en... • https://access.redhat.com/security/cve/CVE-2024-1454 • CWE-416: Use After Free •