CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2008-4306 – enscript: "font" special escape buffer overflows
https://notcve.org/view.php?id=CVE-2008-4306
Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. Vulnerabilidad inespecífica en enscript antes de la v1.6.4 en Ubuntu Linux v6.06 LTS, v7.10, v8.04 y v8.10 que tiene un impacto y unos vectores de ataque desconocidos, posiblemente este relacionado con el desbordamiento de búfer. • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html http://osvdb.org/49569 http://rhn.redhat.com/errata/RHSA-2008-1021.html http://secunia.com/advisories/32521 http://secunia.com/advisories/32530 http://secunia.com/advisories/32753 http://secunia.com/advisories/32854 http://secunia.com/advisories/32970 http://secunia.com/advisories/33109 http://security.gentoo.org/glsa/glsa-200812-02.xml http://support.avaya.com/elmodocs2/security/ASA-2008-504.htm • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2008-2808 – Firefox file location escaping flaw
https://notcve.org/view.php?id=CVE-2008-2808
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename. Mozilla Firefox anterior a 2.0.0.15 y SeaMonkey anterior a 1.1.10 no escapan correctamente el HTML en listados de directorios file:// URLs, lo que permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) o tener otros impactos no especificados mediante un nombre de archivo modificado. • http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html http://rhn.redhat.com/errata/RHSA-2008-0616.html http://secunia.com/advisories/30878 http://secunia.com/advisories/30898 http://secunia.com/advisories/30903 http://secunia.com/advisories/30911 http://secunia.com/advisories/30949 http://secunia.com/advisories/31005 http://secunia.com/advisories/31008 http://secunia.com/advisories/31021 http://secunia.com/advisories/31023 http://secunia.com/advisories/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2008-2285
https://notcve.org/view.php?id=CVE-2008-2285
The ssh-vulnkey tool on Ubuntu Linux 7.04, 7.10, and 8.04 LTS does not recognize authorized_keys lines that contain options, which makes it easier for remote attackers to exploit CVE-2008-0166 by guessing a key that was not identified by this tool. La herramienta ssh-vulnkey en Ubuntu Linux 7.04, 7.10 y 8.04 LTS no reconoce líneas authorized_keys que contienen opciones, lo que facilita a atacantes remotos explotar CVE-2008-0166 adivinando una clave que no fue identificada por esta herramienta. • http://www.ubuntu.com/usn/usn-612-5 https://exchange.xforce.ibmcloud.com/vulnerabilities/42568 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 4%CPEs: 6EXPL: 0CVE-2008-0172 – boost regular expression NULL dereference flaw
https://notcve.org/view.php?id=CVE-2008-0172
The get_repeat_type function in basic_regex_creator.hpp in the Boost regex library (aka Boost.Regex) in Boost 1.33 and 1.34 allows context-dependent attackers to cause a denial of service (NULL dereference and crash) via an invalid regular expression. La función get_repeat_type en basic_regex_creator.hpp de la librería de expresiones regulares (también conocido como Boost.Regex) de Boost 1.33 y 1.34 permite a atacantes remotos dependientes de contexto provocar una denegación de servicio (referencia nula y caída) mediante una expresión regular inválida. • http://bugs.gentoo.org/show_bug.cgi?id=205955 http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://secunia.com/advisories/28511 http://secunia.com/advisories/28527 http://secunia.com/advisories/28545 http://secunia.com/advisories/28705 http://secunia.com/advisories/28860 http://secunia.com/advisories/28943 http://secunia.com/advisories/29323 http://secunia.com/advisories/48099 http://svn.boost.org/trac/boost/changeset/42674 http://svn.boost • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 7.2EPSS: 90%CPEs: 222EXPL: 1CVE-2007-5365 – Ubuntu 6.06 - DHCPd Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-5365
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU. Un desbordamiento de búfer en la región stack de la memoria en la función cons_options en el archivo options.c en dhcpd en OpenBSD versiones 4.0 hasta 4.2, y algunas otras implementaciones de dhcpd basadas en ISC dhcp-2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (bloqueo del demonio) por medio de una petición DHCP que especifica un tamaño máximo de mensaje más pequeño que el IP MTU mínimo. • https://www.exploit-db.com/exploits/4601 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446354 http://secunia.com/advisories/27160 http://secunia.com/advisories/27273 http://secunia.com/advisories/27338 http://secunia.com/advisories/27350 http://secunia.com/advisories/32668 http://securitytracker.com/id?1021157 http://sunsolve.sun.com/search/document.do?assetkey=1-21-109077-21-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-243806-1 http://www.coresecurity&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •