CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2018-14522
https://notcve.org/view.php?id=CVE-2018-14522
An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes. Se ha descubierto un problema en aubio 0.4.6. Puede ocurrir una señal SEGV en aubio_pitch_set_unit en pitch/pitch.c, tal y como queda demostrado con aubionotes. • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00031.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00071.html https://github.com/aubio/aubio/issues/188 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2018-10875 – ansible: ansible.cfg is being read from current working directory allowing possible code execution
https://notcve.org/view.php?id=CVE-2018-10875
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. Se ha encontrado un error en ansible. ansible.cfg se lee desde el directorio de trabajo actual, que puede alterarse para hacer que señale a un plugin o una ruta de módulo bajo el control de un atacante, permitiendo que el atacante ejecute código arbitrario. It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html http://www.securitytracker.com/id/1041396 https://access.redhat.com/errata/RHBA-2018:3788 https://access.redhat.com/errata/RHSA-2018:2150 https://access.redhat.com/errata/RHSA-2018:2151 https://access.redhat.com/errata/RHSA-2018:2152 https://access.redhat.com/errata/RHSA-2018:2166 https://access.redhat.com/errata/RHSA-2018:2321 https://access.redhat.com/errata/RHSA-2018:2585 https://access.redhat.co • CWE-426: Untrusted Search Path •
CVSS: 6.6EPSS: 0%CPEs: 9EXPL: 0CVE-2018-11053 – iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability
https://notcve.org/view.php?id=CVE-2018-11053
Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content. El módulo de servicio Dell EMC iDRAC para todas las versiones de Linux compatibles y las versiones v3.0.1, v3.0.2, v3.1.0 y v3.2.0 de XenServer, cuando se inicia, cambia el permiso de archivo por defecto de los archivos hosts del sistema operativo anfitrión (/etc/hosts) para que sea modificable por cualquier usuario. Un proceso o usuario del sistema operativo con bajos privilegios podría modificar el archivo host y poder redirigir el tráfico desde el destino original a sitios que albergan contenido malicioso o no deseado. • http://www.dell.com/support/article/us/en/19/sln310281/ism-dell-emc-idrac-service-module-improper-file-permission-vulnerability?lang=en http://www.securityfocus.com/bid/104567 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2011-4190 – Missing verification of host key for kdump server
https://notcve.org/view.php?id=CVE-2011-4190
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files). La implementación kdump carece de la verificación de clave host en la integración OpenSSH de kdump y mkdumprd de kdump en versiones anteriores al 2012-01-20. Esto es similar a CVE-2011-3588, pero se diferencian en que la implementación de kdump es específica de SUSE. • https://bugzilla.suse.com/show_bug.cgi?id=722440 https://www.suse.com/security/cve/CVE-2011-4190 • CWE-306: Missing Authentication for Critical Function CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-3172 – unix2_chkpwd do not check for a valid account
https://notcve.org/view.php?id=CVE-2011-3172
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12. Una vulnerabilidad en pam_modules de SUSE Linux Enterprise permite a los atacantes iniciar sesión en cuentas que deberían haberse desactivado. Las versiones afectadas son SUSE Linux Enterprise: versiones anteriores a la 12. • https://bugzilla.suse.com/show_bug.cgi?id=707645 https://build.opensuse.org/request/show/80346 • CWE-264: Permissions, Privileges, and Access Controls CWE-304: Missing Critical Step in Authentication •