CVSS: 9.3EPSS: 4%CPEs: 73EXPL: 0CVE-2020-0605
https://notcve.org/view.php?id=CVE-2020-0605
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606. Se presenta una vulnerabilidad de ejecución de código remota en el software .NET cuando el software presenta un fallo al comprobar el marcado de origen de un archivo. Un atacante que explota con éxito la vulnerabilidad podría ejecutar código arbitrario en el contexto del usuario actual, también se conoce como ".NET Framework Remote Code Execution Vulnerability". Este ID de CVE es diferente de CVE-2020-0606. • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0605 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 52EXPL: 2CVE-2015-6305 – Cisco AnyConnect Secure Mobility Client 3.1.08009 - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-6305
Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211. Vulnerabilidad en la ruta de búsqueda no fiable en la función CMainThread::launchDownloader en vpndownloader.exe en Cisco AnyConnect Secure Mobility Client 2.0 hasta la versión 4.1 en Windows, permite a usuarios locales obtener privilegios a través de un troyano DLL en el directorio de trabajo actual, según lo demostrado por dbghelp.dll, también conocida como Bug ID CSCuv01279. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2015-4211. Cisco AnyConnect Secure Mobility Client version 3.1.08009 suffers from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/38289 http://packetstormsecurity.com/files/133876/Cisco-AnyConnect-Secure-Mobility-Client-3.1.08009-Privilege-Elevation.html http://seclists.org/fulldisclosure/2015/Sep/80 http://tools.cisco.com/security/center/viewAlert.x?alertId=41136 http://www.securitytracker.com/id/1033643 https://code.google.com/p/google-security-research/issues/detail?id=460 • CWE-426: Untrusted Search Path •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2015-4211
https://notcve.org/view.php?id=CVE-2015-4211
Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCus65862. Cisco AnyConnect Secure Mobility Client 3.1(60) en Windows no valida correctamente los nombres de rutas, lo que permite a usuarios locales ganar privilegios a través de un fichero INF manipulado, también conocido como Bug ID CSCus65862. • http://tools.cisco.com/security/center/viewAlert.x?alertId=39466 http://www.securityfocus.com/bid/75373 http://www.securitytracker.com/id/1032704 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 24%CPEs: 216EXPL: 0CVE-2013-3344 – flash-plugin: Multiple code execution flaws (APSB13-17)
https://notcve.org/view.php?id=CVE-2013-3344
Heap-based buffer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via unspecified vectors. Desbordamiento de memoria dinámica en Adobe Flash Player anterior a 11.7.700.232 y 11.8.x anterior a 11.8.800.94 en Windows y Mac OS X, anterior a 11.2.202.297 en Linux, anterior a 11.1.111.64 en Android 2.x y 3.x,anterior a 11.1.115.69 en Android 4.x, permite a atacantes ejecutar código arbitrario a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html http://www.adobe.com/support/security/bulletins/apsb13-17.html http://www.securityfocus.com/bid/61043 https://access.redhat.com/security/cve/CVE-2013-3344 https://bugzilla.redhat.com/show_bug.cgi?id=982749 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 2%CPEs: 216EXPL: 0CVE-2013-3347 – Adobe Flash Player Integer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-3347
Integer overflow in Adobe Flash Player before 11.7.700.232 and 11.8.x before 11.8.800.94 on Windows and Mac OS X, before 11.2.202.297 on Linux, before 11.1.111.64 on Android 2.x and 3.x, and before 11.1.115.69 on Android 4.x allows attackers to execute arbitrary code via PCM data that is not properly handled during resampling. Desbordamiento de entero en Adobe Flash Player anterior a 11.7.700.232 y 11.8.x anterior a 11.8.800.94 en Windows y Mac OS X, anterior a 11.2.202.297 en Linux, anterior a 11.1.111.64 en Android 2.x y 3.x,anterior a 11.1.115.69 en Android 4.x, permite a atacantes ejecutar código arbitrario a través de datos PCM que no son manejados correctamente durante el "resampling". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the PCM processing code. By providing a malformed audio sample through ActionScript3, an attacker can cause an integer overflow. • http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00021.html http://www.adobe.com/support/security/bulletins/apsb13-17.html https://access.redhat.com/security/cve/CVE-2013-3347 https://bugzilla.redhat.com/show_bug.cgi?id=982749 • CWE-189: Numeric Errors •