CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2014-1829 – Ubuntu Security Notice USN-2382-1
https://notcve.org/view.php?id=CVE-2014-1829
14 Oct 2014 — Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request. Requests(también conocido como python-requests) anterior a 2.3.0 permite a atacantes remotos obtener una contraseña netrc leyendo la cabecera 'Authorization' en una petición de redirección. Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file through redirect requests, if the user has their pas... • http://advisories.mageia.org/MGASA-2014-0409.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 1CVE-2014-7204 – Mandriva Linux Security Advisory 2014-206
https://notcve.org/view.php?id=CVE-2014-7204
06 Oct 2014 — jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a crafted JavaScript file. jscript.c en Exuberant Ctags 5.8 permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU y disco) a través de un fichero JavaScript manipulado. It was discovered that Exuberant Ctags incorrectly handled certain minified js files. An attacker could use this issue to possibly cause Exuberant Ctags to consume res... • http://advisories.mageia.org/MGASA-2014-0415.html • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 89%CPEs: 345EXPL: 23CVE-2014-7169 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7169
25 Sep 2014 — GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a ... • https://packetstorm.news/files/id/128650 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-228: Improper Handling of Syntactically Invalid Structure •
CVSS: 10.0EPSS: 94%CPEs: 345EXPL: 135CVE-2014-6271 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-6271
24 Sep 2014 — GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." N... • https://packetstorm.news/files/id/181111 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 22%CPEs: 16EXPL: 2CVE-2014-5461 – Gentoo Linux Security Advisory 202305-23
https://notcve.org/view.php?id=CVE-2014-5461
02 Sep 2014 — Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments. Desbordamiento de buffer en las funciones vararg en ldo.c en Lua 5.1 hasta 5.2.x anterior a 5.2.3 permite a atacantes dependientes de contexto causar una denegación de servicio (caída) a través de un número pequeño de argumentos en una función con un número grande de... • http://advisories.mageia.org/MGASA-2014-0414.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 19EXPL: 0CVE-2014-2524 – Mandriva Linux Security Advisory 2014-154
https://notcve.org/view.php?id=CVE-2014-2524
08 Aug 2014 — The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. La función _rl_tropen en util.c en GNU readline anterior a 6.3 patch 3 permite a usuarios locales crear o sobrescribir ficheros arbitrarios a través de un ataque de enlace simbólico sobre un fichero /var/tmp/rltrace.[PID]. Steve Kemp discovered the _rl_tropen() function in readline insecurely handled a temporary file. • http://advisories.mageia.org/MGASA-2014-0319.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 2%CPEs: 11EXPL: 0CVE-2014-3429 – Mandriva Linux Security Advisory 2014-157
https://notcve.org/view.php?id=CVE-2014-3429
07 Aug 2014 — IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. IPython Notebook 0.12 hasta 1.x anterior a 1.2 no valida el origen de las solicitudes de Websockets, lo que permite a atacantes remotos ejecutar código arbitrario mediante el aprovechamiento de conocimiento del kernel id y una página manipulada. In IPython before 1.2, the origin of websocket reque... • http://advisories.mageia.org/MGASA-2014-0320.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2013-4159 – Mandriva Linux Security Advisory 2015-177
https://notcve.org/view.php?id=CVE-2013-4159
06 Aug 2014 — ctdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files securely, which has unspecified impact related to "several temp file vulnerabilities" in (1) tcp/tcp_connect.c, (2) server/eventscript.c, (3) tools/ctdb_diagnostics, (4) config/gdb_backtrace, and (5) include/ctdb_private.h. ctdb anterior a 2.3 en OpenSUSE 12.3 y 13.1 no crea ficheros temporales con seguridad, lo que tiene un impacto no especificado relacionado con 'varias vulnerabilidades de ficheros temporales' en (1) tcp/tcp_connect... • http://advisories.mageia.org/MGASA-2014-0274.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 0CVE-2014-3532 – Mandriva Linux Security Advisory 2014-148
https://notcve.org/view.php?id=CVE-2014-3532
03 Jul 2014 — dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded. dbus 1.3.0 anterior a 1.6.22 y 1.8.x anterior a 1.8.6, cuando funciona en Linux 2.6.37-rc4 o posteriores, permite a usuarios locales causar una denegación de servicio (desconexión... • http://advisories.mageia.org/MGASA-2014-0294.html • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 38EXPL: 0CVE-2014-3533 – Mandriva Linux Security Advisory 2014-148
https://notcve.org/view.php?id=CVE-2014-3533
03 Jul 2014 — dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor. dbus 1.3.0 anterior a 1.6.22 y 1.8.x anterior a 1.8.6 permite a usuarios locales causar una denegación de servicio (desconexión) a través de cierta secuencias de mensajes manipulados que causan que el demonio de dbus reenvíe un mensaje que contiene un descriptor de fichero... • http://advisories.mageia.org/MGASA-2014-0294.html • CWE-20: Improper Input Validation •