CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2010-3846 – cvs: Heap-based buffer overflow by applying RCS file changes
https://notcve.org/view.php?id=CVE-2010-3846
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow. Error de índice de array en la función apply_rcs_change de rcs.c de CVS v1.11.23 permite a usuarios locales aumentar sus privilegios mediante un fichero RCS que contenga cambios en un fragmento delta manipulado que provoquen un desbordamiento de búfer basado en memoria dinámica (heap). • http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050212.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050287.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050090.html http://secunia.com/advisories/41079 http://secunia.com/advisories/42041 http://secunia.com/advisories/42409 http://www.osvdb.org/68952 http: • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-0359 – Samizdat 0.6.1 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2009-0359
Multiple cross-site scripting (XSS) vulnerabilities in Samizdat before 0.6.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message title or (2) user full name. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Samizdat anterior a v0.6.2 permite a usuarios autenticados remotamente inyectar secuencias de comando web o HTML de su elección a través del (1) título del mensaje o (2) nombre completo de usuario. Samizdat versions 0.6.1 and below suffer from a persistent cross site scripting vulnerability. • http://osvdb.org/52022 http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-xss-escape-title.patch http://www.mail-archive.com/debian-testing-security-announce%40lists.debian.org/msg00171.html http://www.nongnu.org/samizdat/release-notes/samizdat-0.6.2.html http://www.securityfocus.com/archive/1/500961/100/0/threaded http://www.securityfocus.com/bid/33768 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2007-3209
https://notcve.org/view.php?id=CVE-2007-3209
Mail Notification 4.0, when WITH_SSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which allows remote attackers to obtain sensitive information by sniffing the network. Mail Notification 4.0, cuando WITH_SSL tiene asignado el 0 en tiempo de compilación, utiliza conexiones no encripatadas para configuración de cuentas con SSL/TLS, lo cual permite a atacantes remotos obtener información sensible esnifando la red. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=428157 http://osvdb.org/37205 http://secunia.com/advisories/25600 https://exchange.xforce.ibmcloud.com/vulnerabilities/34814 https://savannah.nongnu.org/bugs/index.php?20131 •