CVSS: 6.7EPSS: 0%CPEs: 31EXPL: 0CVE-2022-21505 – kernel: lockdown bypass using IMA
https://notcve.org/view.php?id=CVE-2022-21505
20 Apr 2023 — In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). An authentication bypass flaw ... • https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b • CWE-305: Authentication Bypass by Primary Weakness CWE-346: Origin Validation Error •
CVSS: 5.9EPSS: 0%CPEs: 28EXPL: 0CVE-2022-31631 – php: PDO:: quote() may return unquoted string due to an integer overflow
https://notcve.org/view.php?id=CVE-2022-31631
23 Jan 2023 — A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. php: PDO::quote() may return unquoted string due to an integer overflow • https://access.redhat.com/security/cve/CVE-2022-31631 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 0%CPEs: 32EXPL: 0CVE-2024-27834 – Apple Safari Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-27834
18 Aug 2022 — The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. El problema se solucionó con controles mejorados. Este problema se solucionó en iOS 17.5 y iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. • http://seclists.org/fulldisclosure/2024/May/10 • CWE-277: Insecure Inherited Permissions CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-34266
https://notcve.org/view.php?id=CVE-2022-34266
19 Jul 2022 — The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource. El paquete libtiff versión 4.0.3-35.amzn2.0.1 para LibTIFF en Amazon Linux 2 permit... • https://alas.aws.amazon.com/AL2/ALAS-2022-1814.html • CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-0070 – Log4j hot patch package privilege escalation
https://notcve.org/view.php?id=CVE-2022-0070
19 Apr 2022 — Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to. Una corrección incompleta para CVE-2021-3100. El paquete hotpatch de Apache Log4j que comienza con log4j-cve-2021-44228-hotpatch-1.1-16, ahora imitará explícitamente las capacidades de Linux y los cgroups del proceso Java de destino al que es aplicado el hotpatch • https://alas.aws.amazon.com/cve/html/CVE-2022-0070.html • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-3100 – Log4j hot patch package privilege escalation
https://notcve.org/view.php?id=CVE-2021-3100
19 Apr 2022 — The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges. El paquete hotpatch de Apache Log4j anterior a log4j-cve-2021-44228-hotpatch-1.1-13 no imitaba los permisos de la JVM que se parcheaba, lo que permitía escalar privilegios • https://alas.aws.amazon.com/AL2/ALAS-2021-1732.html • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-40830 – Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems
https://notcve.org/view.php?id=CVE-2021-40830
22 Nov 2021 — The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to u... • https://github.com/aws/aws-iot-device-sdk-cpp-v2 • CWE-295: Improper Certificate Validation •
CVSS: 10.0EPSS: 0%CPEs: 12EXPL: 0CVE-2019-15690 – libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overflow
https://notcve.org/view.php?id=CVE-2019-15690
23 Mar 2020 — A flaw was found in libvncserver. An integer overflow within the HandleCursorShape() function can be exploited to cause a heap-based buffer overflow by tricking a user or application using libvncserver to connect to an unstrusted server and subsequently send cursor shapes with specially crafted dimensions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overfl... • https://access.redhat.com/security/cve/CVE-2019-15690 • CWE-122: Heap-based Buffer Overflow •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2016-1000212
https://notcve.org/view.php?id=CVE-2016-1000212
07 Aug 2016 — It was discovered that lighttpd class did not properly protect against the HTTP_PROXY variable name clash in a CGI context. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. •