CVSS: 5.0EPSS: 4%CPEs: 26EXPL: 2CVE-2011-1027
https://notcve.org/view.php?id=CVE-2011-1027
Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence. Error de superación de límite (off-by-one) en la función convert_query_hexchar en html.c en cgit.cgi en cgit anteriores a v0.8.3.5, permite a atacantes remotos provocar una denegación de servicio (buble infinito) a través de una cadena compuesta por un caracter "%" (por ciento) seguido de caracteres hexadecimales no válidos, como se demostró con la secuencia %gg. • http://article.gmane.org/gmane.comp.version-control.git/168493 http://hjemli.net/git/cgit/commit/?h=stable&id=fc384b16fb9787380746000d3cea2d53fccc548e http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055898.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055966.html http://openwall.com/lists/oss-security/2011/03/07/3 http://secunia.com/advisories/43633 http://secunia.com/advi • CWE-193: Off-by-one Error •
CVSS: 5.0EPSS: 14%CPEs: 19EXPL: 5CVE-2011-0762 – vsftpd 2.3.2 - Denial of Service
https://notcve.org/view.php?id=CVE-2011-0762
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632. La función vsf_filename_passes_filter de ls.c de vsftpd en versiones anteriores a la 2.3.3 permite a usuarios autenticados remotos provocar una denegación de servicio (consumo de toda la CPU y agotamiento de los slots de procesos) a través de una expresión glob modificada en comandos STAT en múltiples sesiones FTP. Una vulnerabilidad distinta a la CVE-2010-2632. Vsftpd versions 2.3.2 on NetBSD and 2.3.0 on Ubuntu suffer from a remote denial of service vulnerability. • https://www.exploit-db.com/exploits/16270 ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-2.3.4/Changelog http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622741 http://cxib.net/stuff/vspoc232.c http://jvn.jp/en/jp/JVN37417423/index.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055881.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055882.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055957.html http&# • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 7%CPEs: 45EXPL: 1CVE-2011-1002 – avahi: daemon infinite loop triggered by an empty UDP packet (CVE-2010-2244 fix regression)
https://notcve.org/view.php?id=CVE-2011-1002
avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244. avahi-core/socket.c en avahi-daemon en Avahi antes de v0.6.29 permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de un paquete UDP (1) IPv4 o (2) IPv6 vacíos al puerto 5353. NOTA: esta vulnerabilidad existe debido a una corrección incorrecta del CVE-2010-2244. • http://avahi.org/ticket/325 http://git.0pointer.de/?p=avahi.git%3Ba=commit%3Bh=46109dfec75534fe270c0ab902576f685d5ab3a6 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055858.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://openwall.com/lists/oss-security/2011/02/18/1 http://openwall.com/lists/oss-security/2011/02/18/4 http://osvdb.org/70948 http://secunia.com/advisories/43361 http://secunia.com/advisories/43465 http:/& • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2011-1783 – (mod_dav_svn): DoS (excessive memory use) when configured to provide path-based access control
https://notcve.org/view.php?id=CVE-2011-1783
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data. El módulo mod_dav_svn para Apache HTTP Server, como se distribuye en Apache Subersion v1.5.x y v1.6.x antes de 1.6.17, cuando la opción SVNPathAuthz short_circuit está habilitada permite a atacantes remotos a causar una denegación de servicio (bucle infinito y consumo de memoria) mediante la petición de datos en circunstancias oportunistas. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html http://secunia.com/advisories/44633 http://secunia.com/advisories/44681 http://secunia.com/advisories/44849 http://secunia.com/advisories/44888 http://secunia.com/advisories/45162 http://subversion.apache.org/security/CVE-2011-1783-advisory.txt http://support.ap •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2011-1752 – (mod_dav_svn): DoS (crash) via request to deliver baselined WebDAV resources
https://notcve.org/view.php?id=CVE-2011-1752
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011. Módulo mod_dav_svn para Apache HTTP Server, como se distribuye en Apache Subversion antes de v1.6.17, permite a atacantes remotos provocar una denegación de servicio ( desreferenciar punteros Nulos y caída del demonio ) a través de una solicitud de una línea base de recursos WebDAV, como se explotó en mayo de 2011. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062211.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061913.html http://secunia.com/advisories/44633 http://secunia.com/advisories/44681 http://secunia.com/advisories/44849 http://secunia.com/advisories/44879 http://secunia.com/advisories/44888 http://secunia.com/advisories/45162 http://subversion.apache.org/security/CVE-2011&# • CWE-476: NULL Pointer Dereference •