CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-2581
https://notcve.org/view.php?id=CVE-2014-2581
Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit. Smb4K versiones anteriores a 1.1.1, permite a atacantes remotos obtener credenciales por medio de vectores relacionados con la opción cuid en la edición de línea "Additional options". • http://lists.fedoraproject.org/pipermail/package-announce/2014-June/133898.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/133901.html http://sourceforge.net/projects/smb4k/files/1.1.1 http://www.openwall.com/lists/oss-security/2014/03/24/1 http://www.openwall.com/lists/oss-security/2014/03/25/5 https://bugs.gentoo.org/505376 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.3EPSS: 0%CPEs: 10EXPL: 0CVE-2019-14905 – Ansible: malicious code could craft filename in nxos_file_copy module
https://notcve.org/view.php?id=CVE-2019-14905
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues. Se detectó una vulnerabilidad en Ansible Engine versiones 2.9.x anteriores a 2.9.3, versiones 2.8.x anteriores a 2.8.8, versiones 2.7.x anteriores a 2.7.16 y anteriores, donde en el módulo nxos_file_copy de Ansible puede ser usado para copiar archivos a una flash o bootflash en dispositivos NXOS. Un código malicioso podría diseñar el parámetro filename para llevar a cabo inyecciones de comandos de Sistema Operativo. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html https://access.redhat.com/errata/RHSA-2020:0216 https://access.redhat.com/errata/RHSA-2020:0218 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR https://access.redhat.com/security/cve/CVE-2019-14905 https://bugzilla.red • CWE-20: Improper Input Validation CWE-73: External Control of File Name or Path CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6379 – chromium-browser: use-after-free in speech recognizer
https://notcve.org/view.php?id=CVE-2020-6379
Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en V8 en Google Chrome versiones anteriores a 79.0.3945.130, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html https://crbug.com/1033407 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://security.gentoo.org/glsa/202003-08 https://access.redhat.com/security/cve/CVE-2020-6379 https://bugzilla.redhat.com/show_bug.cgi?id=1793529 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6380 – chromium-browser: extension message verification error
https://notcve.org/view.php?id=CVE-2020-6380
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension. Una aplicación insuficiente de la política en extensions en Google Chrome versiones anteriores a 79.0.3945.130, permitió a un atacante remoto que había comprometido el proceso del renderizador omitir el aislamiento del sitio por medio de una Extensión de Chrome diseñada. • https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html https://crbug.com/1032170 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://security.gentoo.org/glsa/202003-08 https://access.redhat.com/security/cve/CVE-2020-6380 https://bugzilla.redhat.com/show_bug.cgi?id=1793537 • CWE-20: Improper Input Validation CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-6378 – chromium-browser: use-after-free in speech recognizer
https://notcve.org/view.php?id=CVE-2020-6378
Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en speech en Google Chrome versiones anteriores a 79.0.3945.130, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. • https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop_16.html https://crbug.com/1018677 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://security.gentoo.org/glsa/202003-08 https://access.redhat.com/security/cve/CVE-2020-6378 https://bugzilla.redhat.com/show_bug.cgi?id=1793514 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •