CVSS: 9.8EPSS: 3%CPEs: 38EXPL: 0CVE-2018-1000007 – curl: HTTP authentication leak in redirects
https://notcve.org/view.php?id=CVE-2018-1000007
24 Jan 2018 — libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers... • http://www.openwall.com/lists/oss-security/2022/04/27/4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10855
https://notcve.org/view.php?id=CVE-2017-10855
15 Sep 2017 — Untrusted search path vulnerability in FENCE-Explorer for Windows V8.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. Una vulnerabilidad de tipo ruta de búsqueda no confiable en FENCE-Explorer para Windows V8.4.1 y anteriores permite que un atacante consiga privilegios utilizando un archivo DLL troyano en un directorio no especificado. • http://www.fujitsu.com/jp/group/bsc/services/fence/info-2017080101.html • CWE-426: Untrusted Search Path •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2017-3210 – Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution
https://notcve.org/view.php?id=CVE-2017-3210
26 Apr 2017 — Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. • https://packetstorm.news/files/id/142312 • CWE-16: Configuration CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 69%CPEs: 87EXPL: 1CVE-2016-8610 – SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
https://notcve.org/view.php?id=CVE-2016-8610
30 Jan 2017 — A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. Se ha encontrado un fallo de denegación de servicio en OpenSSL en las versiones 0.9.8, 1.0.1, 1.0.2 hasta la 1.0.2h y la 1.1.0 en la forma en la que el protocolo TLS/SSL de... • https://github.com/cujanovic/CVE-2016-8610-PoC • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 48%CPEs: 160EXPL: 0CVE-2015-2808 – SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher
https://notcve.org/view.php?id=CVE-2015-2808
01 Apr 2015 — The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue. El algoritmo RC4, utilizado en el protocolo TLS y el prot... • http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2014-7252
https://notcve.org/view.php?id=CVE-2014-7252
05 Dec 2014 — Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local users to execute arbitrary code or read kernel memory via unknown vectors related to userland data and "improper data validation." Múltiples vulnerabilidades no especificadas en el controlador Syslink para el procesador... • http://jvn.jp/en/jp/JVN67792023/397327/index.html •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2014-7253
https://notcve.org/view.php?id=CVE-2014-7253
05 Dec 2014 — FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allows local users to execute arbitrary commands via unspecified vectors. FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, y REGZA Phone T-01D para Android permiten a usuarios locales ejecutar comandos arbitrarios a través de vectores no especificados. • http://jvn.jp/en/jp/JVN06302787/995312/index.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-7254
https://notcve.org/view.php?id=CVE-2014-7254
05 Dec 2014 — Unspecified vulnerability in ARROWS Me F-11D allows physically proximate attackers to read or modify flash memory via unknown vectors. Vulnerabilidad no especificada en ARROWS Me F-11D permite a atacantes físicamente próximos leer o modificar la memoria flash a través de vectores desconocidos. • http://jvn.jp/en/jp/JVN61593104/995312/index.html •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3898
https://notcve.org/view.php?id=CVE-2014-3898
14 Aug 2014 — Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Fujitsu ServerView Operations Manager 5.00.09 hasta 6.30.05 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://jp.fujitsu.com/platform/server/primequest/products/2000/catalog/manual/support/note_140729_svom.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2013-7105
https://notcve.org/view.php?id=CVE-2013-7105
14 Dec 2013 — Buffer overflow in the Interstage HTTP Server log functionality, as used in Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1, and 10.0.0; and Interstage Studio 9.0.0, 9.1.0, 9.2.0, and 10.0.0, has unspecified impact and attack vectors related to "ihsrlog/rotatelogs." Desbordamiento de búfer en la funcionalidad Interstage HTTP Server log, tal como se utiliza en Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1 y 10.0.0, y Interstage Studio 9.0.0, 9.1.0, 9.2 0.0 y 10.0.0, tiene ... • http://www.fujitsu.com/global/support/software/security/products-f/interstage-201302e.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •