CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39522
https://notcve.org/view.php?id=CVE-2021-39522
An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2len() in bits.c has a heap-based buffer overflow. Se ha detectado un problema en libredwg en la versión 0.10.1.3751. La función bit_wcs2len() en el archivo bits.c presenta un desbordamiento del búfer en la región heap de la memoria • https://github.com/LibreDWG/libredwg/issues/255 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39521
https://notcve.org/view.php?id=CVE-2021-39521
An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function bit_read_BB() located in bits.c. It allows an attacker to cause Denial of Service. Se ha detectado un problema en libredwg versiones hasta 0.10.1.3751. Se presenta una desreferencia de puntero NULL en la función bit_read_BB() ubicada en el archivo bits.c. • https://github.com/LibreDWG/libredwg/issues/262 • CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-39537
https://notcve.org/view.php?id=CVE-2021-39537
An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow. Se ha detectado un problema en ncurses versiones hasta v6.2-1. La función _nc_captoinfo en el archivo captoinfo.c presenta un desbordamiento de búfer en la región heap de la memoria • http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup http://seclists.org/fulldisclosure/2022/Oct/28 http://seclists.org/fulldisclosure/2022/Oct/41 http://seclists.org/fulldisclosure/2022/Oct/43 http://seclists.org/fulldisclosure/2022/Oct/45 https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html https://lists.gnu • CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-38354 – GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-38354
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6. El plugin GNU-Mailman Integration de WordPress, es vulnerable a un ataque de tipo Cross-Site Scripting Reflejado por medio del parámetro gm_error encontrado en el archivo ~/includes/admin/mailing-lists-page.php que permite a atacantes inyectar scripts web arbitrario, en versiones hasta 1.0.6 incluyéndola • https://plugins.trac.wordpress.org/browser/gnu-mailman-integration/trunk/includes/admin/mailing-lists-page.php?rev=859898#L34 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38354 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-40491
https://notcve.org/view.php?id=CVE-2021-40491
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl. El cliente ftp en GNU Inetutils versiones anteriores a 2.2, no comprueba las direcciones devueltas por las respuestas PASV/LSPV para asegurarse de que coinciden con la dirección del servidor. Esto es similar a CVE-2020-8284 para curl • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476 https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html • CWE-345: Insufficient Verification of Data Authenticity •