CVSS: 8.1EPSS: 0%CPEs: 14EXPL: 0CVE-2014-9037 – Wordpress Core < 4.0.1 - Hash Collision
https://notcve.org/view.php?id=CVE-2014-9037
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 podría permitir a atacantes remotos obtener el acceso a una cuenta ociosa desde el 2008 mediante el aprovechamiento de una comparación indebida del tipo dinámico de PHP para un hash MD5. • http://advisories.mageia.org/MGASA-2014-0493.html http://openwall.com/lists/oss-security/2014/11/25/12 http://www.debian.org/security/2014/dsa-3085 http://www.mandriva.com/security/advisories?name=MDVSA-2014:233 http://www.securitytracker.com/id/1031243 https://wordpress.org/news/2014/11/wordpress-4-0-1 • CWE-310: Cryptographic Issues CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 2.1EPSS: 0%CPEs: 26EXPL: 2CVE-2014-7824
https://notcve.org/view.php?id=CVE-2014-7824
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1. D-Bus hasta 1.3.0 y 1.6.x antes de 1.6.26, 1.8.x antes de 1.8.10, y 1.9.x antes de 1.9.2 permite a usuarios locales provocar una denegación de servicio (la prevención de nuevas conexiones y caída de conexión) colocando en cola el número máximo de descriptores de archivos. NOTA: esta vulnerabilidad existe debido a que no se completo la solución para CVE-2014 a 3.636,1. • http://advisories.mageia.org/MGASA-2014-0457.html http://secunia.com/advisories/62603 http://www.debian.org/security/2014/dsa-3099 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2014/11/10/2 http://www.securityfocus.com/bid/71012 http://www.ubuntu.com/usn/USN-2425-1 https://bugs.freedesktop.org/show_bug.cgi?id=85105 https://exchange.xforce.ibmcloud.com/vulnerabilities/98576 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8764
https://notcve.org/view.php?id=CVE-2014-8764
DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind. DokuWiki 2014-05-05a y anteriores, cuando utiliza Active Directory para la autenticación LDAP, permite a atacantes remotos evadir la autenticación a través de un nombre de usuario y una contraseña que empiece por un caracter nulo (\0), lo que provoca un bind anónimo. • http://advisories.mageia.org/MGASA-2014-0438.html http://secunia.com/advisories/61983 http://www.debian.org/security/2014/dsa-3059 http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication http://www.openwall.com/lists/oss-security/2014/10/13/3 http://www.openwall.com/lists/oss-security/2014/10/16/9 https://github.com/splitbrain/dokuwiki/pull/868 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8763
https://notcve.org/view.php?id=CVE-2014-8763
DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind. DokuWiki anterior a 2014-05-05b, cuando utiliza Active Directory para la autenticación LDAP, permite a atacantes remotos evadir la autenticación a través de una contraseña que empiece por un caracter nulo (\0) y un nombre de usuario válido, lo que provoca un bind no autenticado. • http://advisories.mageia.org/MGASA-2014-0438.html http://secunia.com/advisories/61983 http://www.debian.org/security/2014/dsa-3059 http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication http://www.openwall.com/lists/oss-security/2014/10/13/3 http://www.openwall.com/lists/oss-security/2014/10/16/9 https://github.com/splitbrain/dokuwiki/pull/868 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2013-4159
https://notcve.org/view.php?id=CVE-2013-4159
ctdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files securely, which has unspecified impact related to "several temp file vulnerabilities" in (1) tcp/tcp_connect.c, (2) server/eventscript.c, (3) tools/ctdb_diagnostics, (4) config/gdb_backtrace, and (5) include/ctdb_private.h. ctdb anterior a 2.3 en OpenSUSE 12.3 y 13.1 no crea ficheros temporales con seguridad, lo que tiene un impacto no especificado relacionado con 'varias vulnerabilidades de ficheros temporales' en (1) tcp/tcp_connect.c, (2) server/eventscript.c, (3) tools/ctdb_diagnostics, (4) config/gdb_backtrace y (5) include/ctdb_private.h. • http://advisories.mageia.org/MGASA-2014-0274.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00052.html http://wiki.samba.org/index.php/CTDB2releaseNotes#ctdb_2.5 http://www.mandriva.com/security/advisories?name=MDVSA-2015:177 http://www.openwall.com/lists/oss-security/2014/05/29/12 https://bugzilla.redhat.com/show_bug.cgi?id=986773 https://git.samba.org/?p=ctdb.git%3Ba=commitdiff%3Bh=b9b9f6738fba5c32e87cb9c36b358355b444fb9b • CWE-264: Permissions, Privileges, and Access Controls •