CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-8449 – squid: Improper input validation issues in HTTP Request processing
https://notcve.org/view.php?id=CVE-2020-8449
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters. Se detectó un problema en Squid versiones anteriores a 4.10. Debido a una comprobación de entrada incorrecta, puede interpretar las peticiones HTTP diseñadas de manera no prevista para acceder a recursos del servidor prohibidos por parte de los filtros de seguridad anteriores. A flaw was found in squid. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html http://www.squid-cache.org/Advisories/SQUID-2020_1.txt http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch http://www.squid-cache.org/Versions&# • CWE-20: Improper Input Validation CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2019-20446 – librsvg: Resource exhaustion via crafted SVG file with nested patterns
https://notcve.org/view.php?id=CVE-2019-20446
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially. En el archivo xml.rs en GNOME librsvg versiones anteriores a 2.46.2, un archivo SVG diseñado con patrones anidados puede causar una denegación de servicio cuando es pasado a la biblioteca para su procesamiento. El atacante construye elementos de patrón para que el número de objetos renderizados finales aumente exponencialmente. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00024.html https://gitlab.gnome.org/GNOME/librsvg/issues/515 https://lists.debian.org/debian-lts-announce/2020/07/msg00016.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP https://security.netapp.com/advisory/ntap-20221111-0004 https://usn.ubuntu.com/443 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2013-0294
https://notcve.org/view.php?id=CVE-2013-0294
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack. El archivo packet.py en pyrad versiones anteriores a 2.1, utiliza números aleatorios débiles para generar autenticadores RADIUS y contraseñas de hash, lo que facilita a atacantes remotos obtener información confidencial por medio de un ataque de fuerza bruta. • http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115677.html http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115705.html http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116567.html http://www.openwall.com/lists/oss-security/2013/02/15/13 http://www.securityfocus.com/bid/57984 https://bugzilla.redhat.com/show_bug.cgi?id=911682 https://exchange.xforce.ibmcloud.com/vulnerabilities/82133 https://github.com/wichert/pyrad/commit/38f7 • CWE-330: Use of Insufficiently Random Values •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2013-1895
https://notcve.org/view.php?id=CVE-2013-1895
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten. El módulo py-bcrypt versiones anteriores a 0.3 para Python, no maneja apropiadamente el acceso concurrente a la memoria, que permite a atacantes omitir la autenticación por medio de múltiples peticiones de autenticación, lo que desencadena que el hash de contraseña se sobrescriba. • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html http://www.openwall.com/lists/oss-security/2013/03/26/2 http://www.securityfocus.com/bid/58702 https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-1437
https://notcve.org/view.php?id=CVE-2013-1437
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value. Una vulnerabilidad de inyección de Eval en el módulo Module-Metadata versiones anteriores a 1.000015 para Perl, permite a atacantes remotos ejecutar código de Perl arbitrario por medio del valor $Version. • http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114904.html http://lists.fedoraproject.org/pipermail/package-announce/2013-August/114912.html https://metacpan.org/changes/distribution/Module-Metadata • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •