CVSS: 4.6EPSS: 0%CPEs: 6EXPL: 0CVE-2013-0241 – qxl: synchronous io guest DoS
https://notcve.org/view.php?id=CVE-2013-0241
The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information. El controlador QXL en QXL Virtual GPU v0.1.0 permite a usuarios locales causar una denegación de servicio (caída o bloqueo del SO invitado) a través de una conexión SPICE que evita otros hilos obtenidos del mutex qemu_mutex. NOTA: Alguno de estos detalles han sido obtenidos a partir de información de terceros. • http://rhn.redhat.com/errata/RHSA-2013-0218.html http://secunia.com/advisories/52021 http://www.mandriva.com/security/advisories?name=MDVSA-2013:138 http://www.openwall.com/lists/oss-security/2013/01/30/3 http://www.openwall.com/lists/oss-security/2013/01/30/4 http://www.ubuntu.com/usn/USN-1714-1 https://bugzilla.redhat.com/show_bug.cgi?id=906032 https://exchange.xforce.ibmcloud.com/vulnerabilities/81704 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-00 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 5%CPEs: 63EXPL: 0CVE-2013-0189
https://notcve.org/view.php?id=CVE-2013-0189
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison. cachemgr.cgi en Squid v3.1.x, v3.2.x y posiblemente, v3.1.22, v3.2.4 y otras versiones, permite a atacantes remotos provocar una denegación de servicio (consumo de recursos) a través de una solicitud hecha a mano. NOTA: este problema se debe a una solución incorrecta para CVE-2012-5643, posiblemente con un orden incorrecto de argumentos o de comparación incorrecta. • http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743 http://bazaar.launchpad.net/~squid/squid/3.2/revision/11744 http://lists.fedoraproject.org/pipermail/scm-commits/2013-January/934637.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00025.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00032.html http://sec • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.0EPSS: 0%CPEs: 7EXPL: 1CVE-2013-0212 – openstack-glance: Backend password leak in Glance error message
https://notcve.org/view.php?id=CVE-2013-0212
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages. store/swift.py en OpenStack Glance Essex (2012.1), Folsom (2012.2) anterior a 2012.2.3, y Grizzly, cuando el modo singe tenant en Swift, guarda el usuario Swift remoto y el password en texto plano cuando el punto remoto es mal configurado, lo que permite a usuarios remotos autenticados obtener información sensible mediante la lectura de mensajes de error. • https://github.com/LogSec/CVE-2013-0212 http://rhn.redhat.com/errata/RHSA-2013-0209.html http://secunia.com/advisories/51957 http://secunia.com/advisories/51990 http://ubuntu.com/usn/usn-1710-1 http://www.openwall.com/lists/oss-security/2013/01/29/10 https://bugs.launchpad.net/glance/+bug/1098962 https://bugzilla.redhat.com/show_bug.cgi?id=902964 https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 https://github.com/openstack/glance/commit/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-0208 – openstack-nova: Boot from volume allows access to random volumes
https://notcve.org/view.php?id=CVE-2013-0208
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter. La función de arranque de volumen en OpenStack Compute (Nova) Folsom y Essex, al utilizar NOVA-volúmenes, permite a usuarios remotos autenticados para arrancar desde volúmenes de otros usuarios a través de un identificador de volumen en el parámetro block_device_mapping. • http://osvdb.org/89661 http://rhn.redhat.com/errata/RHSA-2013-0208.html http://secunia.com/advisories/51963 http://secunia.com/advisories/51992 http://www.openwall.com/lists/oss-security/2013/01/29/9 http://www.securityfocus.com/bid/57613 http://www.ubuntu.com/usn/USN-1709-1 https://bugs.launchpad.net/nova/+bug/1069904 https://bugzilla.redhat.com/show_bug.cgi?id=902629 https://exchange.xforce.ibmcloud.com/vulnerabilities/81697 https://github.com/openstack/n • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 2CVE-2012-5656
https://notcve.org/view.php?id=CVE-2012-5656
The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack. El proceso de rasterización en Inkscape antes de v0.48.4 permite a los usuarios locales leer archivos de su elección a través de entidades externas en un archivo SVG. Se trata de un ataque también conocido como ataque de inyección XML a una entidad externa (XXE). • http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931 http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095398.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00041.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00043.html http://www.openwall.com/lists/oss-security/2012/12/20 • CWE-611: Improper Restriction of XML External Entity Reference •