CVSS: 2.6EPSS: 6%CPEs: 24EXPL: 4CVE-2006-3672 – KDE Konqueror 3.5.x - ReplaceChild Denial of Service
https://notcve.org/view.php?id=CVE-2006-3672
KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 (zero) argument. KDE Konqueror 3.5.1 y anteriores permite a atacantes remotos provocar denegación de servicio (caida de aplicación) a través de la llamada al método replaceChild sobre un objeto DOM, el cual dispara una referencia NULL, somo se demostró con la llamada a document.replaceChild con un argumento 0 (zero). • https://www.exploit-db.com/exploits/28220 http://browserfun.blogspot.com/2006/07/mobb-14-konqueror-replacechild.html http://www.mandriva.com/security/advisories?name=MDKSA-2006:130 http://www.osvdb.org/27058 http://www.securityfocus.com/bid/18978 http://www.ubuntu.com/usn/usn-322-1 http://www.vupen.com/english/advisories/2006/2812 https://exchange.xforce.ibmcloud.com/vulnerabilities/27744 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2006-2916
https://notcve.org/view.php?id=CVE-2006-2916
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges. artswrapper en aRts, cuando se ejecuta como root sobre linux 2.6.0 o versiones posteriores, no valida la variable setuid de retorno de la llamada a la función, lo que permite a usuarios locales ganar privilegios de root al provocar un fallo sobre setuid. • http://dot.kde.org/1150310128 http://mail.gnome.org/archives/beast/2006-December/msg00025.html http://secunia.com/advisories/20677 http://secunia.com/advisories/20786 http://secunia.com/advisories/20827 http://secunia.com/advisories/20868 http://secunia.com/advisories/20899 http://secunia.com/advisories/25032 http://secunia.com/advisories/25059 http://security.gentoo.org/glsa/glsa-200704-22.xml http://securitytracker.com/id?1016298 http://slackware.com/security/viewer.php? • CWE-273: Improper Check for Dropped Privileges •
CVSS: 4.0EPSS: 0%CPEs: 14EXPL: 0CVE-2006-2449
https://notcve.org/view.php?id=CVE-2006-2449
KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login. KDE Display Manager (KDM) en KDE v3.2.0 a v3.5.3 permite a usuarios locales leer archivos de su elección mediante un ataque de enlaces simbólicos relaciado con el tipo de sesión elegido en el inicio de sesión • http://secunia.com/advisories/20602 http://secunia.com/advisories/20660 http://secunia.com/advisories/20674 http://secunia.com/advisories/20702 http://secunia.com/advisories/20785 http://secunia.com/advisories/20869 http://secunia.com/advisories/20890 http://secunia.com/advisories/21662 http://securitytracker.com/id?1016297 http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.444467 http://www.debian.org/security/2006/dsa-1156 http://www. •
CVSS: 7.5EPSS: 17%CPEs: 17EXPL: 0CVE-2006-0019
https://notcve.org/view.php?id=CVE-2006-0019
Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI. • ftp://ftp.kde.org/pub/kde/security_patches/post-3.4.3-kdelibs-kjs.diff http://secunia.com/advisories/18500 http://secunia.com/advisories/18540 http://secunia.com/advisories/18552 http://secunia.com/advisories/18559 http://secunia.com/advisories/18561 http://secunia.com/advisories/18570 http://secunia.com/advisories/18583 http://secunia.com/advisories/18899 http://securityreason.com/securityalert/364 http://securitytracker.com/id?1015512 http://slackware.com/security/viewer&# •
CVSS: 5.0EPSS: 0%CPEs: 127EXPL: 1CVE-2005-3626
https://notcve.org/view.php?id=CVE-2005-3626
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference. • ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html http://rhn.redhat.com/errata/RHSA-2006-0177.html http://scary.beasts.org/security/CESA-2005-003.txt http://secunia.com/ • CWE-399: Resource Management Errors •