CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-14348 – libcgroup: cgrulesengd creates log files with insecure permissions
https://notcve.org/view.php?id=CVE-2018-14348
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information. libcgroup hasta el incluyendo la versión 0.41 crea /var/log/cgred con el modo 0666 independientemente del umask configurado, lo que conduce a una fuga de información. • http://lists.opensuse.org/opensuse-security-announce/2018-08/msg00023.html https://access.redhat.com/errata/RHSA-2019:2047 https://bugzilla.suse.com/show_bug.cgi?id=1100365 https://lists.debian.org/debian-lts-announce/2018/08/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3VH333EONOEEGKOLHHFXCJYHCYMHJ4KK https://sourceforge.net/p/libcg/libcg/ci/0d88b73d189ea3440ccaab00418d6469f76fa590 https://access.redhat.com/security/cve/CVE-2018-14348 https://bug • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2017-18342
https://notcve.org/view.php?id=CVE-2017-18342
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function. En PyYAML en versiones anteriores a 5.1, la API yaml.load () podría ejecutar código arbitrario si se usara con datos no confiables. La función load () ha quedado en desuso en la versión 5.1 y se ha introducido el "UnsafeLoader" para una compatibilidad hacia atrás con la función. • https://github.com/marshmallow-code/apispec/issues/278 https://github.com/yaml/pyyaml/blob/master/CHANGES https://github.com/yaml/pyyaml/issues/193 https://github.com/yaml/pyyaml/pull/74 https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load%28input%29-Deprecation https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE http • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 8%CPEs: 7EXPL: 0CVE-2018-10811
https://notcve.org/view.php?id=CVE-2018-10811
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable. strongSwan, en versiones 5.6.0 y anteriores, permite una denegación de servicio (DoS) remota debido a la falta de inicialización de una variable. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html https://download.strongswan.org/security/CVE-2018-10811 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBO6ZQKLB5RY3TV7MXADFTQKXA2LUEIL https://security.gentoo.org/glsa/201811-16 https://usn.ubuntu.com/3771-1 https://www.debian.org/security& • CWE-909: Missing Initialization of Resource •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-11385
https://notcve.org/view.php?id=CVE-2018-11385
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker. Se ha descubierto un problema en el componente Security en Symfony en versiones 2.7.x anteriores a la 2.7.48, versiones 2.8.x anteriores a la 2.8.41, versiones 3.3.x anteriores a la 3.3.17, versiones 3.4.x anteriores a la 3.4.11 y versiones 4.0.x anteriores a la 4.0.11. Una vulnerabilidad de fijación de sesión en la característica de inicio de sesión "Guard" podría permitir que un atacante suplante a una víctima en la aplicación web si el valor de ID de sesión ya era anteriormente conocido para el atacante. • https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication https://www.de • CWE-384: Session Fixation •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-10196
https://notcve.org/view.php?id=CVE-2018-10196
NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file. Vulnerabilidad de desreferencia de puntero NULL en la función ebuild_vlists en lib/dotgen/conc.c en la biblioteca dotgen en Graphviz 2.40.1 permite que atacantes remotos provoquen una denegación de servicio (cierre inesperado de la aplicación) mediante un archivo manipulado. • https://bugzilla.redhat.com/show_bug.cgi?id=1579254 https://gitlab.com/graphviz/graphviz/issues/1367 https://lists.debian.org/debian-lts-announce/2021/05/msg00014.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VR2CT3LD52GWAQUZAOSEXSYE3O7HGN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TWUEEJPMS5LAROYJYY6FREOTI6VPN3M4 https://usn.ubuntu.com/3731-1 • CWE-476: NULL Pointer Dereference •