CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3897
https://notcve.org/view.php?id=CVE-2019-3897
It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue. Se ha detectado en redhat-certification que cualquier usuario no autorizado puede descargar cualquier archivo en /var/www/rhcert, siempre que conozca su nombre. Red Hat Certification versiones 6 y 7 son vulnerables a este problema • https://bugzilla.redhat.com/show_bug.cgi?id=1593768 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 3.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-20239 – kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure
https://notcve.org/view.php?id=CVE-2021-20239
A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality. Se encontró un fallo en el kernel de Linux en versiones anteriores a 5.4.92 en el protocolo BPF. Este fallo permite a un atacante con una cuenta local filtrar información sobre las direcciones internas del kernel. • https://bugzilla.redhat.com/show_bug.cgi?id=1923636 https://access.redhat.com/security/cve/CVE-2021-20239 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-822: Untrusted Pointer Dereference •
CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 0CVE-2021-20179 – pki-core: Unprivileged users can renew any certificate
https://notcve.org/view.php?id=CVE-2021-20179
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity. Se encontró un fallo en pki-core. Un atacante que haya comprometido con éxito una clave podría usar este fallo para renovar el certificado correspondiente una y otra vez, siempre que no se revoque explícitamente. • https://bugzilla.redhat.com/show_bug.cgi?id=1914379 https://github.com/dogtagpki/pki/pull/3474 https://github.com/dogtagpki/pki/pull/3475 https://github.com/dogtagpki/pki/pull/3476 https://github.com/dogtagpki/pki/pull/3477 https://github.com/dogtagpki/pki/pull/3478 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDOLFOLEIV7I4EUC3SCZBXL6E2ER7ZEN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRE44N6P24AEDKRMWK7 • CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-20261
https://notcve.org/view.php?id=CVE-2021-20261
A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw. Se encontró una condición de carrera en la implementación del kernel de Linux del software manejador del controlador de la unidad de disquete. • https://bugzilla.redhat.com/show_bug.cgi?id=1932150 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a0c80efe5956ccce9fe7ae5c78542578c07bc20a • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2020-35524 – libtiff: Heap-based buffer overflow in TIFF2PDF tool
https://notcve.org/view.php?id=CVE-2020-35524
A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se encontró un error de desbordamiento de búfer en la región heap de la memoria en libtiff en el manejo de imágenes TIFF en la herramienta TIFF2PDF de libtiff. Un archivo TIFF especialmente diseñado puede conllevar a una ejecución de código arbitraria. • https://bugzilla.redhat.com/show_bug.cgi?id=1932044 https://gitlab.com/libtiff/libtiff/-/merge_requests/159 https://gitlab.com/rzkn/libtiff/-/commit/7be2e452ddcf6d7abca88f41d3761e6edab72b22 https://lists.debian.org/debian-lts-announce/2021/06/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMHBYFMX3D5VGR6Y3RXTTH3Q4NF4E6IG https://security.gentoo.org/glsa/202104-06 https://security.netapp.com/advisory/ntap-20210521-0009 https://www.debian.org/se • CWE-787: Out-of-bounds Write •