CVSS: 6.5EPSS: 94%CPEs: 13EXPL: 10CVE-2020-11652 – SaltStack Salt Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2020-11652
30 Apr 2020 — An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Se descubrió un problema en SaltStack Salt versiones anteriores a la versión 2019.2.4 y versiones 3000 anteriores a 3000.2. La clase ClearFuncs del proceso Salt-master permite acceder a algunos métodos que sanean inapropiadamente las rutas. • https://packetstorm.news/files/id/180608 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 94%CPEs: 38EXPL: 40CVE-2020-1938 – Apache Tomcat Improper Privilege Management Vulnerability
https://notcve.org/view.php?id=CVE-2020-1938
24 Feb 2020 — When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected... • https://packetstorm.news/files/id/180825 • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2012-5828
https://notcve.org/view.php?id=CVE-2012-5828
10 Feb 2020 — BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error BlackBerry PlayBook versiones anteriores a 2.1, presenta una vulnerabilidad de divulgación de información por medio de un error del componente navegador Web. • http://www.securityfocus.com/bid/56793 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 3%CPEs: 371EXPL: 1CVE-2019-9506 – Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
https://notcve.org/view.php?id=CVE-2019-9506
14 Aug 2019 — The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing. La especificación de Bluetooth BR/EDR incluyendo versión 5.1, permite una longitud de clave de cifrado suficientemente baja y no impide que un atacante influya en la negociación d... • https://github.com/francozappa/knob • CWE-310: Cryptographic Issues CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-8998
https://notcve.org/view.php?id=CVE-2019-8998
12 Jul 2019 — An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Software Development Platform version(s) 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen process address space. Una vulnerabilidad de divulgación de información que conlleva a una potencial escalada local de privilegios en el servicio procfs (el sistema de archivos /proc) de la Plataforma de Desarrollo de... • http://support.blackberry.com/kb/articleDetail?articleNumber=000057178 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-8999
https://notcve.org/view.php?id=CVE-2019-8999
18 Apr 2019 — An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account. Una vulnerabilidad de entidad externa XML en el UEM Core de BlackBerry UEM anterior a la versión 12.10.1a podría permitir a un atacante conseguir acceso de lectura a archivos en cualquier sistema accesible por la cuenta de servicio UEM. • http://support.blackberry.com/kb/articleDetail?articleNumber=000056241 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.9EPSS: 9%CPEs: 1EXPL: 1CVE-2019-8997
https://notcve.org/view.php?id=CVE-2019-8997
21 Mar 2019 — An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XML in an existing field. Una vulnerabilidad XEE (XML External Entity) en el sistema de gestión (consola) de BlackBerry AtHoc, en versiones anteriores a la 7.6 HF-567, podría permitir que un atacante lea archivos ... • https://github.com/nxkennedy/CVE-2019-8997 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8888
https://notcve.org/view.php?id=CVE-2018-8888
20 Dec 2018 — A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. Una vulnerabilidad Cross-Site Scripting (XSS) persistente en la consola de gestión de BlackBerry UEM, en versiones anteriores a la 12.10.0, podría permitir que un atacante almacene comandos script que podrían ejecutarse posteriormente en el contexto ... • http://support.blackberry.com/kb/articleDetail?articleNumber=000054162 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8891
https://notcve.org/view.php?id=CVE-2018-8891
20 Dec 2018 — Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to store script commands that could later be executed in the context of another Management Console administrator. Múltiples vulnerabilidades Cross-Site Scripting (XSS) persistente en la consola de gestión de BlackBerry UEM, en versiones anteriores a la 12.9.1, podrían permitir que un atacante almacene comandos script que podrían ejecutarse posteriormente... • http://support.blackberry.com/kb/articleDetail?articleNumber=000054162 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8892
https://notcve.org/view.php?id=CVE-2018-8892
20 Dec 2018 — A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modifications to the UEM settings in the context of a Management Console administrator. Una vulnerabilidad Cross-Site Request Forgery (CSRF) en la consola de gestión de BlackBerry UEM, en versiones anteriores a la 12.9.1, podría permitir que un atacante modifique las opciones de UEM en el contexto de un administrador de la consola. • http://support.blackberry.com/kb/articleDetail?articleNumber=000054162 • CWE-352: Cross-Site Request Forgery (CSRF) •