CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 1CVE-2019-14744 – kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction
https://notcve.org/view.php?id=CVE-2019-14744
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file. En KDE Frameworks KConfig en versiones anteriores a 5.61.0, los archivos de escritorio y los archivos de configuración maliciosos conllevan a la ejecución de código con una interacción mínima del usuario. Esto se relaciona con el archivo libKF5ConfigCore.so y el manejo inapropiado de archivos .desktop y .directory, como es demostrado por un comando de shell en una línea Icon en un archivo .desktop. A flaw was found in the KDE Frameworks KConfig prior to version 5.61.0. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html https://access.redhat.com/errata/RHSA-2019:2606 https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt https://lists.deb • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-454: External Initialization of Trusted Variables or Data Stores •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14463
https://notcve.org/view.php?id=CVE-2019-14463
An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301. Se descubrió un problema en LIbmodbus anterior a 3.0.7 y 3.1 x anterior a 3.1.5. hay una lectura fuera de límites para el caso MODBUS_FC_WRITE_MULTIPLE_REGISTERS, también conocido como VD_-1301 • https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc https://libmodbus.org/2019/stable-and-development-releases https://lists.debian.org/debian-lts-announce/2021/11/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233 • CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14462
https://notcve.org/view.php?id=CVE-2019-14462
An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302. Un problema fue descubierto en LIbmodbus anterior a 3.0.7 y 3.1 x anterior a 3.1.5. hay lectura fuera de límites para el caso MODBUS_FC_WRITE_MULTIPLE_COILS , también conocido como VD-1302 • https://github.com/stephane/libmodbus/commit/5ccdf5ef79d742640355d1132fa9e2abc7fbaefc https://libmodbus.org/2019/stable-and-development-releases https://lists.debian.org/debian-lts-announce/2021/11/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAGHQFJTJCMYHW553OUWJ3YIJR6PJHB7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRAQZXGAZY6UGWZ6CD33QEFLL7AWW233 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 1CVE-2019-14459
https://notcve.org/view.php?id=CVE-2019-14459
nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service). nfdump 1.6.17 y versiones anteriores se ven afectadas por un desbordamiento de enteros en la función Process_ipfix_template_withdraw en ipfix.c que se puede abusar para bloquear el proceso de forma remota (denegación de servicio). • https://github.com/phaag/nfdump/commit/3b006ededaf351f1723aea6c727c9edd1b1fff9b https://github.com/phaag/nfdump/issues/171 https://lists.debian.org/debian-lts-announce/2020/09/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULSZMKA7P7REJMANVL7D6WMZ2L7IRSET https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTONOGJU5FSMFNRCT6OHXYUMDRKH4RPA https://security.gentoo.org/glsa/202003-17 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 45EXPL: 1CVE-2019-14439 – jackson-databind: Polymorphic typing issue related to logback/JNDI
https://notcve.org/view.php?id=CVE-2019-14439
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath. Se detectó un problema de escritura polimórfica en jackson-databind de FasterXML versiones 2.x anteriores a 2.9.9.2. Esto ocurre cuando la Escritura Predeterminada está habilitada (globalmente o para una propiedad específica) para un endpoint JSON expuesto externamente y el servicio tiene el jar de logback en el classpath. • https://github.com/jas502n/CVE-2019-14439 https://access.redhat.com/errata/RHSA-2019:3200 https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2 https://github.com/FasterXML/jackson-databind/issues/2389 https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E https://lists.apache.org/thread.html/2d2a76440becb610b9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-502: Deserialization of Untrusted Data •