CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2011-4915
https://notcve.org/view.php?id=CVE-2011-4915
fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts. El archivo fs/proc/base.c en el kernel de Linux versiones hasta 3.1, permite a usuarios locales obtener información confidencial de pulsaciones de teclas por medio del acceso a /proc/interrupts. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0499680a42141d86417a8fbaa8c8db806bea1201 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a2ef990ab5a6705a356d146dd773a3b359787497 http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-4915.html http://www.openwall.com/lists/oss-security/2011/11/07/9 https://lkml.org/lkml/2011/11/7/340 https://seclists.org/oss-sec/2011/q4/571 https://security-tracker.debian.org/tracker/CVE- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 7%CPEs: 13EXPL: 1CVE-2020-9273
https://notcve.org/view.php?id=CVE-2020-9273
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution. En ProFTPD versión 1.3.7, es posible corromper los grupos de memoria mediante la interrupción del canal de transferencia de datos. Esto conlleva a un uso de la memoria previamente liberada en la función alloc_pool en el archivo pool.c, y una posible ejecución de código remota. • https://github.com/ptef/CVE-2020-9273 http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html http://www.openwall.com/lists/oss-security/2021/08/25/1 http://www.openwall.com/lists/oss-security/2021/09/06/2 https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES https://github.com/proftpd/proftpd/issues/903 https://lists.debian.org/debian-lts-announce/2020/02/msg00022.html https:/& • CWE-416: Use After Free •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-20479 – mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash
https://notcve.org/view.php?id=CVE-2019-20479
A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. Se detectó un fallo en mod_auth_openidc versiones anteriores a 2.4.1. Se presenta un problema de redireccionamiento abierto en las URL con una barra diagonal y una barra diagonal inversa al principio. An open redirect flaw was discovered in mod_auth_openidc where it handles logout redirection. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00036.html https://github.com/zmartzone/mod_auth_openidc/commit/02431c0adfa30f478cf2eb20ed6ea51fdf446be7 https://github.com/zmartzone/mod_auth_openidc/pull/453 https://lists.debian.org/debian-lts-announce/2020/02/msg00035.html https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org&#x • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 96%CPEs: 4EXPL: 2CVE-2020-8518 – Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-8518
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. Horde Groupware Webmail Edition versión 5.2.22, permite una inyección de código PHP arbitrario, por medio de datos CSV, conllevando a una ejecución de código remota. • https://www.exploit-db.com/exploits/48215 http://packetstormsecurity.com/files/156872/Horde-5.2.22-CSV-Import-Code-Execution.html https://lists.debian.org/debian-lts-announce/2020/04/msg00008.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PRPIFQDGYPQ3F2TF2ETPIL7IYNSVVZQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKTNYDBDVJNMVC7QPXQI7CMPLX3USZ2T https://lists.horde.org/archives/announce/2020/001285.html https://cardaci. • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 2CVE-2016-2338
https://notcve.org/view.php?id=CVE-2016-2338
An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow. Se presenta una vulnerabilidad de desbordamiento de pila explotable en la función Psych::Emitter start_document de Ruby. En la función Psych::Emitter start_document la asignación de "head" del buffer de heap es realizada en base a la longitud del array de etiquetas. • https://github.com/SpiralBL0CK/CVE-2016-2338-nday http://www.talosintelligence.com/reports/TALOS-2016-0032 https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html https://security.netapp.com/advisory/ntap-20221228-0005 • CWE-787: Out-of-bounds Write •