CVSS: 6.8EPSS: 1%CPEs: 142EXPL: 0CVE-2014-8104 – Mandriva Linux Security Advisory 2014-246
https://notcve.org/view.php?id=CVE-2014-8104
02 Dec 2014 — OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet. OpenVPN 2.x anterior a 2.0.11, 2.1.x, 2.2.x anterior a 2.2.3, y 2.3.x anterior a 2.3.6 permite a usuarios remotos autenticados causar una denegación de servicio (caída del servidor) a través de un paquete de canal de control pequeño. Dragana Damjanovic discovered that OpenVPN incorrectly handled certain control channel ... • http://advisories.mageia.org/MGASA-2014-0512.html • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 3CVE-2014-9116 – Mandriva Linux Security Advisory 2014-245
https://notcve.org/view.php?id=CVE-2014-9116
01 Dec 2014 — The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function. La función write_one_header en mutt 1.5.23 no maneja correctamente los caracteres de línea nueva al inicio de una cabecera, lo que permite a atacantes remotos causar una denegación de servicio (caída) a través de una ... • http://advisories.mageia.org/MGASA-2014-0509.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2014-9087 – Debian Security Advisory 3078-1
https://notcve.org/view.php?id=CVE-2014-9087
28 Nov 2014 — Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow. Desbordamiento de enteros en la función ksba_oid_to_str en Libksba anterior a 1.3.2, utilizado en GnuPG, permite a atacantes remotos causar una denegación de servicio (caída) a través de un OID manipulado en (1) un mensaje S/MIME o (2) datos OpenPGP b... • http://advisories.mageia.org/MGASA-2014-0498.html • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2014-9037 – Wordpress Core < 4.0.1 - Hash Collision
https://notcve.org/view.php?id=CVE-2014-9037
20 Nov 2014 — WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 podría permitir a atacantes remotos obtener el acceso a una cuenta ociosa desde el 2008 mediante el aprovechamiento de una comparación indebida del tipo dinámico de PHP para un hash... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-310: Cryptographic Issues CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2014-9039 – WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset
https://notcve.org/view.php?id=CVE-2014-9039
20 Nov 2014 — wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-login.php en WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 podría permitir a atacantes remotos reconfigurar las contraseñas mediante el aprovechamiento del acceso a una cuenta de email que recibió un mensaje de reconfiguració... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-254: 7PK - Security Features CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8764 – Debian Security Advisory 3059-1
https://notcve.org/view.php?id=CVE-2014-8764
22 Oct 2014 — DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind. DokuWiki 2014-05-05a y anteriores, cuando utiliza Active Directory para la autenticación LDAP, permite a atacantes remotos evadir la autenticación a través de un nombre de usuario y una contraseña que empiece por un caracter nulo (\0), lo que provoca un bind anónimo. Two vuln... • http://advisories.mageia.org/MGASA-2014-0438.html • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8763 – Debian Security Advisory 3059-1
https://notcve.org/view.php?id=CVE-2014-8763
22 Oct 2014 — DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind. DokuWiki anterior a 2014-05-05b, cuando utiliza Active Directory para la autenticación LDAP, permite a atacantes remotos evadir la autenticación a través de una contraseña que empiece por un caracter nulo (\0) y un nombre de usuario válido, lo que provoca un bind no ... • http://advisories.mageia.org/MGASA-2014-0438.html • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 97%CPEs: 147EXPL: 6CVE-2014-3566 – SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack
https://notcve.org/view.php?id=CVE-2014-3566
15 Oct 2014 — The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. El protocolo SSL 3.0, utilizado en OpenSSL hasta 1.0.1i y otros productos, utiliza relleno (padding) CBC no determinístico, lo que facilita a los atacantes man-in-the-middle obtener datos de texto plano a través de un ataque de relleno (padding) oracle, también conocid... • https://github.com/mikesplain/CVE-2014-3566-poodle-cookbook • CWE-310: Cryptographic Issues CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2014-1829 – Ubuntu Security Notice USN-2382-1
https://notcve.org/view.php?id=CVE-2014-1829
14 Oct 2014 — Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request. Requests(también conocido como python-requests) anterior a 2.3.0 permite a atacantes remotos obtener una contraseña netrc leyendo la cabecera 'Authorization' en una petición de redirección. Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their pas... • http://advisories.mageia.org/MGASA-2014-0409.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2014-7204 – Mandriva Linux Security Advisory 2014-206
https://notcve.org/view.php?id=CVE-2014-7204
06 Oct 2014 — jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a crafted JavaScript file. jscript.c en Exuberant Ctags 5.8 permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU y disco) a través de un fichero JavaScript manipulado. It was discovered that Exuberant Ctags incorrectly handled certain minified js files. An attacker could use this issue to possibly cause Exuberant Ctags to consume res... • http://advisories.mageia.org/MGASA-2014-0415.html • CWE-399: Resource Management Errors •