CVSS: 5.5EPSS: 0%CPEs: 13EXPL: 0CVE-2014-3690 – kernel: kvm: vmx: invalid host cr4 handling across vm entries
https://notcve.org/view.php?id=CVE-2014-3690
31 Oct 2014 — arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU. arch/x86/kvm/vmx.c en el subsistema KVM en el kernel de Linux anterior a 3.17.2 en los procesadores Intel no asegur... • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d974baa398f34393db76be45f7d4d04fbdbb4a0a • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 1CVE-2014-1505 – Mozilla: SVG filters information disclosure through feDisplacementMap (MFSA 2014-28)
https://notcve.org/view.php?id=CVE-2014-1505
18 Mar 2014 — The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693. La implementación del filtro SVG en Mozilla Firefox anterior a 28.0, Firefox ESR 24.x anterior a 24.4, Thunderbir... • http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 1%CPEs: 2EXPL: 0CVE-2012-0414
https://notcve.org/view.php?id=CVE-2012-0414
02 Dec 2013 — Cross-site scripting (XSS) vulnerability in the Spacewalk service in SUSE Manager 1.2 for SUSE Linux Enterprise (SLE) 11 SP1 allows remote attackers to inject arbitrary web script or HTML via an image name. Vulnerabilidad de XSS en el servicio Spacewalk de SUSE Manager 1.2 para SUSE Linux Enterprise (SLE) 11 SP1 permite a atacantes remotos inyectar script web o HTML arbitrario a través de un nombre de imagen. • http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5145796.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2012-0426
https://notcve.org/view.php?id=CVE-2012-0426
02 Dec 2013 — Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory. Condición de carrera en sap_suse_cluster_connector anterior a la versión 1.0.0-0.8.1 en SUSE Linux Enterprise para SAP Applications 11 SP2 permite a usuarios locales generar un impacto no especificado a través de vectores relacionados con un directorio tmp/. • http://download.novell.com/Download?buildid=DshQViDsMLE~ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 2%CPEs: 44EXPL: 2CVE-2013-4589 – Gentoo Linux Security Advisory 201311-10
https://notcve.org/view.php?id=CVE-2013-4589
19 Nov 2013 — The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image. La función ExportAlphaQuantumType en export.c de GraphicsMagick anterior a la versión 1.3.18 podría permitir a atacantes remotos provocar una denegación de servicio (caída) a través de vectores relacionados con la exportación de alpha de una imagen RGBA de 8-bit. Multiple vulnerabilities have been ... • http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120008.html •
CVSS: 7.8EPSS: 79%CPEs: 109EXPL: 0CVE-2013-4854 – ISC BIND rdata Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2013-4854
26 Jul 2013 — The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013. La implementación RFC en rdata.c en ISC BIND 9.7.x y 9.8.x anterior a 9.8.5-P2, ... • http://archives.neohapsis.com/archives/bugtraq/2013-08/0030.html •
CVSS: 7.5EPSS: 6%CPEs: 41EXPL: 0CVE-2013-3567 – puppet: remote code execution on master from unauthenticated clients
https://notcve.org/view.php?id=CVE-2013-3567
19 Jun 2013 — Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. Puppet 2.7.x anterior a 2.7.22 y 3.2.x anterior a 3.2.2, y Puppet Enterprise anterior a 2.8.2, deserializa YAML sin confianza, lo que permite a atacantes remotos la instanciación de clases de Ruby y ejecutar código arbitrario a través de una llamada RESTAPI manipulada. Pu... • http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 0CVE-2011-0995
https://notcve.org/view.php?id=CVE-2011-0995
13 May 2011 — The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors. La gema sqlite3-ruby en el paquete rubygem-sqlite3 antes de v1.2.4-0.5.1 en SUSE Linux Enterprise (SLE) v11 SP1 utiliza permisos débiles para archivos no especificados, lo que permite a usuarios locales conseguir privilegios a través de vectores desconocidos. • http://secunia.com/advisories/44418 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2011-0988
https://notcve.org/view.php?id=CVE-2011-0988
18 Apr 2011 — pure-ftpd 1.0.22, as used in SUSE Linux Enterprise Server 10 SP3 and SP4, and Enterprise Desktop 10 SP3 and SP4, when running OES Netware extensions, creates a world-writeable directory, which allows local users to overwrite arbitrary files and gain privileges via unspecified vectors. pure-ftpd 1.0.22, tal como se utiliza en SUSE Linux Enterprise Server 10 Service Pack 3 y Service Pack 4, y Enterprise Desktop 10 Service Pack 3 y Service Pack 4, cuando se ejecutan las extensiones OES Netware, crea un directo... • http://secunia.com/advisories/44039 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2010-3912
https://notcve.org/view.php?id=CVE-2010-3912
12 Jan 2011 — The supportconfig script in supportutils in SUSE Linux Enterprise 11 SP1 and 10 SP3 does not "disguise passwords" in configuration files, which has unknown impact and attack vectors. La secuencia de comandos en supportconfig en supportutils en el SP3 de SUSE Linux Enterprise v11 Service Pack 1 y 10 no "disfraza contraseñas" en los archivos de configuración, que tiene un impacto y vectores de ataque desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html • CWE-255: Credentials Management Errors •