CVSS: 9.8EPSS: 91%CPEs: 9EXPL: 3CVE-2014-2323 – HP Security Bulletin HPSBGN03191 1
https://notcve.org/view.php?id=CVE-2014-2323
13 Mar 2014 — SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname. Vulnerabilidad de inyección SQL en mod_mysql_vhost.c en lighttpd anterior a 1.4.35 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del nombre de host, relacionado con request_check_hostname. A potential security vulnerabilities have been identified with HP Remote Device Access: Virtual Customer Access... • https://github.com/cirocosta/lighty-sqlinj-demo • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 78%CPEs: 11EXPL: 3CVE-2014-2324 – HP Security Bulletin HPSBGN03191 1
https://notcve.org/view.php?id=CVE-2014-2324
13 Mar 2014 — Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname. Múltiples vulnerabilidades de salto de directorio en (1) mod_evhost y (2) mod_simple_vhost en lighttpd anterior a 1.4.35 permiten a atacantes remotos leer archivos arbitrarios a través de un .. (punto punto) en el nombre de host, relacionado con request_check_hostname. A potenti... • https://github.com/sp4c30x1/uc_httpd_exploit • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 37%CPEs: 13EXPL: 0CVE-2014-2270 – file: out-of-bounds access in search rules with offsets from input file
https://notcve.org/view.php?id=CVE-2014-2270
12 Mar 2014 — softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable. softmagic.c en archivo anterior a 5.17 y libmagic permite a atacantes dependientes de contexto causar una denegación de servicio (acceso a memoria fuera de rango y caída) a través de desplazamientos (“offsets”) manipulados en el softmagic de un ejecutable PE. A denial of service flaw was found in the way ... • http://bugs.gw.com/view.php?id=313 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 2%CPEs: 26EXPL: 0CVE-2014-0467 – mutt: heap-based buffer overflow when parsing certain headers
https://notcve.org/view.php?id=CVE-2014-0467
12 Mar 2014 — Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion. Desbordamiento de buffer en copy.c en Mutt anterior a 1.5.23 permite a atacantes remotos causar una denegación de servicio (caída) a través de una línea de cabecera RFC2047 manipulada, relacionado con la expansión de dirección. Mutt is a text-mode mail user agent. A heap-based buffer overflow flaw was found in the way mutt processed cer... • http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 0CVE-2014-1958 – Debian Security Advisory 2898-1
https://notcve.org/view.php?id=CVE-2014-1958
06 Mar 2014 — Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030. Un desbordamiento del búfer en la función DecodePSDPixels en el archivo coders/psd.c en ImageMagick versiones anteriores a 6.8.8-5, podría permitir a atacantes remotos ejecutar código arbitrario por medio de una imagen PSD diseñada, que involucra la cadena L%06ld... • http://lists.opensuse.org/opensuse-updates/2014-03/msg00032.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 10%CPEs: 7EXPL: 1CVE-2014-2030 – ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)
https://notcve.org/view.php?id=CVE-2014-2030
06 Mar 2014 — Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947. Un desbordamiento del búfer en la región stack de la memoria en la función WritePSDImage en el archivo coders/psd.c en ImageMagick, posiblemente versión 6.8.8-5, permite a atacantes remotos causar una denega... • https://www.exploit-db.com/exploits/31688 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2012-2328 – sblim: hash table collisions CPU usage DoS
https://notcve.org/view.php?id=CVE-2012-2328
10 Feb 2014 — internal/cimxml/sax/NodeFactory.java in Standards-Based Linux Instrumentation for Manageability (SBLIM) Common Information Model (CIM) Client (aka sblim-cim-client2) before 2.1.12 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML file. internal/cimxml/sax/NodeFactory.java en el cliente Common Information Model (CIM) de Standards-Based Linux Instrumentation for ... • http://lists.opensuse.org/opensuse-updates/2012-12/msg00015.html • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2013-2191
https://notcve.org/view.php?id=CVE-2013-2191
08 Feb 2014 — python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate. python-bugzilla anterior a 0.9.0 no valida los certificados X.509 , lo que permite a atacantes man-in-the-middle falsificar servidores Bugzilla a través de un certificado manipulado. • http://lists.opensuse.org/opensuse-updates/2013-07/msg00025.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 1%CPEs: 9EXPL: 0CVE-2014-1478 – Ubuntu Security Notice USN-2102-2
https://notcve.org/view.php?id=CVE-2014-1478
06 Feb 2014 — Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors. Múltiples vulnerabilidades no especificadas en el motor de navegación en Mozilla Firefox anterior a 27.0 y Sea... • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html • CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 13EXPL: 0CVE-2014-1480 – Ubuntu Security Notice USN-2102-2
https://notcve.org/view.php?id=CVE-2014-1480
06 Feb 2014 — The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site. La implementación de descarga de archivos en Mozilla Firefox anterior a 27.0 y SeaMonkey anterior a 2.24 no restringe debidamente el tiempo de las selecciones de botón, lo que permite a atacantes remotos llevar a cabo at... • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •