CVSS: 2.1EPSS: 0%CPEs: 19EXPL: 0CVE-2013-4208
https://notcve.org/view.php?id=CVE-2013-4208
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys. La función rsa_verify en PuTTY anterior a 0.63 (1) no limpia de memoria los procesos sensibles después de usarlos y (2)no libera determinadas estructuras que contienen procesos sensibles, lo que podría permitir a usuarios locales descubrir claves privadas RSA y DSA. • http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html http://secunia.com/advisories/54379 http://secunia.com/advisories/54533 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html http://www.debian.org/security/2013/dsa-2736 http://www.openwall.com/lists/oss-security/2013/08/06/11 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 2%CPEs: 57EXPL: 0CVE-2013-4852
https://notcve.org/view.php?id=CVE-2013-4852
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow. Desbordamiento de entero en PuTTY 0.62 y anteriores, WinSCP anterior a 5.1.6, y otros productos que usan PuTTY, permite a servidores SSH remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario en determinadas aplicaciones que utilizan PuTTY a través de un tamaño negativo en el valor de la firma en la clave RSA durante el handshake SSH, que provoca un desbordamiento basado en memoria dinámica. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718779 http://lists.opensuse.org/opensuse-updates/2013-08/msg00035.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00041.html http://secunia.com/advisories/54379 http://secunia.com/advisories/54517 http://secunia.com/advisories/54533 http://svn.tartarus.org/sgt?view=revision&sortby=date&revision=9896 http://winscp.net/tracker/show_bug.cgi?id=1017 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature&# • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2013-1769
https://notcve.org/view.php?id=CVE-2013-1769
A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted message. Un algoritmo de hash concreto en Telepathy Gabble 0.16.x anterior a la versión 0.16.5 y 0.17.x anterior a 0.17.3 permite a atacantes remotos provocar una denegación de servicio (dereferencia a puntero nulo y caída) a través de un mensaje manipulado. • http://lists.freedesktop.org/archives/telepathy/2013-March/006377.html http://lists.freedesktop.org/archives/telepathy/2013-March/006378.html http://lists.opensuse.org/opensuse-updates/2013-03/msg00085.html http://secunia.com/advisories/53779 http://www.ubuntu.com/usn/USN-1873-1 • CWE-310: Cryptographic Issues •
CVSS: 6.8EPSS: 0%CPEs: 10EXPL: 0CVE-2013-1431
https://notcve.org/view.php?id=CVE-2013-1431
The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks. El módulo Wocky de Telepathy Gabble anteriores a 0.16.6 y 0.17.x anteriores a 0.17.4, al conectarse a "legacy Jabber server", no hace respetar apropiadamente la bandera WockyConnector.tls-required, lo cual permite a atacantes remotos sortear la verificación TLS y ejecutar ataques man-in-the-middle. • http://seclists.org/oss-sec/2013/q2/438 http://secunia.com/advisories/53779 http://www.debian.org/security/2013/dsa-2702 http://www.ubuntu.com/usn/USN-1873-1 https://bugs.freedesktop.org/show_bug.cgi?id=65036 • CWE-20: Improper Input Validation •
CVSS: 2.6EPSS: 0%CPEs: 9EXPL: 0CVE-2012-4469
https://notcve.org/view.php?id=CVE-2012-4469
Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el módulo Hashcash v6.x-2.x antes de v6.x-2.6 y v7.x-2.x antes de v7.x-2.2 para Drupal, cuando está habilitada la funcion "Log Failed hascash", permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un token válido, lo cual no es correctamente gestionado cuando los administradores utilizan el módulo de registro de base de datos. • http://drupal.org/node/1650784 http://drupal.org/node/1650790 http://drupal.org/node/1663306 http://www.openwall.com/lists/oss-security/2012/10/04/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •