CVSS: 9.0EPSS: 0%CPEs: 36EXPL: 1CVE-2024-3596 – RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
https://notcve.org/view.php?id=CVE-2024-3596
09 Jul 2024 — RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. El protocolo RADIUS según RFC 2865 es susceptible a ataques de falsificación por parte de un atacante local que puede modificar cualquier respuesta válida (acceso-aceptación, acceso-rechazo o acceso-desafío) a cualquier otra respuesta... • https://github.com/alperenugurlu/CVE-2024-3596-Detector • CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel •
CVSS: 6.2EPSS: 0%CPEs: 18EXPL: 0CVE-2024-5569 – Denial of Service via crafted zip file in jaraco/zipp
https://notcve.org/view.php?id=CVE-2024-5569
09 Jul 2024 — A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp... • https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.6EPSS: 0%CPEs: 14EXPL: 0CVE-2024-6409 – Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9
https://notcve.org/view.php?id=CVE-2024-6409
08 Jul 2024 — A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd serve... • http://www.openwall.com/lists/oss-security/2024/07/08/2 • CWE-364: Signal Handler Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2024-39689 – Certifi removes GLOBALTRUST root certificate
https://notcve.org/view.php?id=CVE-2024-39689
05 Jul 2024 — Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long... • https://github.com/roy-aladin/InfraTest • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2205
https://notcve.org/view.php?id=CVE-2022-2205
03 Jul 2024 — RESERVEDNOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2022-30/#CVE-2022-2205 (CVE-2022-2205) An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. (CVE-2022-31744) A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when opening a Windows shortc... •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2024-29506
https://notcve.org/view.php?id=CVE-2024-29506
03 Jul 2024 — Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name. • https://bugs.ghostscript.com/show_bug.cgi?id=707510 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-29507
https://notcve.org/view.php?id=CVE-2024-29507
03 Jul 2024 — Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters. • https://bugs.ghostscript.com/show_bug.cgi?id=707510 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 3.3EPSS: 0%CPEs: 13EXPL: 0CVE-2024-29508
https://notcve.org/view.php?id=CVE-2024-29508
03 Jul 2024 — Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. • https://bugs.ghostscript.com/show_bug.cgi?id=707510 •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2024-29509
https://notcve.org/view.php?id=CVE-2024-29509
03 Jul 2024 — Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle. • https://bugs.ghostscript.com/show_bug.cgi?id=707510 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-29511
https://notcve.org/view.php?id=CVE-2024-29511
03 Jul 2024 — Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd. Artifex Ghostscript anterior a 10.03.1, cuando se usa Tesseract para OCR, tiene un problema de directory traversal que permite la lectura de archivos arbitrarios (y la escritura de mensajes de error en archivos arbitrar... • https://bugs.ghostscript.com/show_bug.cgi?id=707510 • CWE-489: Active Debug Code •