CVSS: 10.0EPSS: 0%CPEs: 25EXPL: 0CVE-2022-48624 – less: missing quoting of shell metacharacters in LESSCLOSE handling
https://notcve.org/view.php?id=CVE-2022-48624
19 Feb 2024 — close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. close_altfile en filename.c en less antes de 606 omite las llamadas shell_quote para LESSCLOSE. A flaw was found in less. The close_altfile() function in filename.c omits shell_quote calls for LESSCLOSE, a command line to invoke the optional input postprocessor. This issue could lead to an OS command injection vulnerability and arbitrary command execution on the host operating system. • https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 39EXPL: 1CVE-2023-50868 – bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
https://notcve.org/view.php?id=CVE-2023-50868
13 Feb 2024 — The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. El aspecto Closest Encloser Proof del protocolo DNS (en RFC 5155 cuando se omite la guía RFC 9276) permite a a... • https://github.com/Goethe-Universitat-Cybersecurity/NSEC3-Encloser-Attack • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-25110 – Azure IoT Platform Device SDK Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-25110
12 Feb 2024 — The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability. UAMQP es una librería C de uso general para AMQP 1.0. • https://github.com/Azure/azure-uamqp-c/commit/30865c9ccedaa32ddb036e87a8ebb52c3f18f695 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 0CVE-2024-1062 – 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)
https://notcve.org/view.php?id=CVE-2024-1062
12 Feb 2024 — A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. Se encontró una falla de desbordamiento de búfer de almacenamiento dinámico en 389-ds-base. Este problema provoca una denegación de servicio al escribir un valor superior a 256 caracteres en log_entry_attr. • https://access.redhat.com/errata/RHSA-2024:1074 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2024-25741 – Ubuntu Security Notice USN-7156-1
https://notcve.org/view.php?id=CVE-2024-25741
12 Feb 2024 — printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact. Printer_write en drivers/usb/gadget/function/f_printer.c en el kernel de Linux hasta 6.7.4 no llama correctamente a usb_ep_queue, lo que podría permitir a los atacantes provocar una denegación de servicio o tener otro impacto no especificado. Chenyuan Yang discovered that the USB Gadget subsy... • https://www.spinics.net/lists/linux-usb/msg252167.html •
CVSS: 8.8EPSS: 0%CPEs: 23EXPL: 0CVE-2024-25744 – kernel: untrusted VMM can trigger int80 syscall handling
https://notcve.org/view.php?id=CVE-2024-25744
12 Feb 2024 — In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. En el kernel de Linux anterior a 6.6.7, un VMM que no es de confianza puede activar el manejo de llamadas al sistema int80 en cualquier punto dado. Esto está relacionado con arch/x86/coco/tdx/tdx.c y arch/x86/mm/mem_encrypt_amd.c. A flaw was found in the Linux kernel. • https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.7 •
CVSS: 5.5EPSS: 0%CPEs: 29EXPL: 0CVE-2024-1151 – Kernel: stack overflow problem in open vswitch kernel module leading to dos
https://notcve.org/view.php?id=CVE-2024-1151
11 Feb 2024 — A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues. Se informó una vulnerabilidad en el subcomponente Open vSwitch del kernel de Linux. • https://access.redhat.com/errata/RHSA-2024:4823 • CWE-121: Stack-based Buffer Overflow •
CVSS: 3.3EPSS: 0%CPEs: 7EXPL: 0CVE-2023-46051
https://notcve.org/view.php?id=CVE-2023-46051
29 Jan 2024 — TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem. TeX Live 944e257 permite una desreferencia de puntero NULL en texk/web2c/pdftexdir/tounicode.c. NOTA: esto está en disputa porque debería categorizarse como un problema de usabilidad. • http://seclists.org/fulldisclosure/2024/Jan/68 • CWE-476: NULL Pointer Dereference •
CVSS: 6.2EPSS: 0%CPEs: 9EXPL: 0CVE-2023-46048
https://notcve.org/view.php?id=CVE-2023-46048
29 Jan 2024 — Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem. Tex Live 944e257 tiene una desreferencia de puntero NULL en texk/web2c/pdftexdir/writet1.c. NOTA: esto está en disputa porque debería categorizarse como un problema de usabilidad. • http://seclists.org/fulldisclosure/2024/Jan/65 • CWE-476: NULL Pointer Dereference •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2023-45935
https://notcve.org/view.php?id=CVE-2023-45935
29 Jan 2024 — Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server. Se descubrió que Qt 6 a 6.6 contenía una desreferencia de puntero NULL mediante la función QXcbConnection::initializeAllAtoms(). NOTA: esto está en disputa porque no se espera que una aplicación X continúe ejecutándose cuando hay ... • http://seclists.org/fulldisclosure/2024/Jan/61 • CWE-476: NULL Pointer Dereference •