CVSS: 2.1EPSS: 0%CPEs: 12EXPL: 0CVE-2013-0348
https://notcve.org/view.php?id=CVE-2013-0348
thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file. thttpd.c en sthttpd antes de 2.26.4-r2 y httpd 2.25b usa permisos de lectura universales para / var / log / thttpd.log, lo que permite a usuarios locales obtener información sensible mediante la lectura del archivo. • http://lists.opensuse.org/opensuse-updates/2013-12/msg00050.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00015.html http://opensource.dyc.edu/gitweb/?p=sthttpd.git%3Ba=commitdiff%3Bh=d2e186dbd58d274a0dea9b59357edc8498b5388d http://www.openwall.com/lists/oss-security/2013/02/23/7 https://bugs.gentoo.org/show_bug.cgi?id=458896 https://bugzilla.redhat.com/show_bug.cgi?id=924857 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 71EXPL: 0CVE-2013-2031
https://notcve.org/view.php?id=CVE-2013-2031
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox. MediaWiki anteriores a 1.19.6, y 1.20.x anteriores a 1.20.5, permite a atacantes remotos realizar ataques cross-site scripting (XSS), como demostrado por una sección CDATA conteniendo secuencias válidas codificadas con UTF-7 en un fichero SVG, el cual es interpretado incorrectamente como UTF-8 por Chrome y Firefox. • http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html http://secunia.com/advisories/55433 http://secunia.com/advisories/57472 http://security.gentoo.org/glsa/glsa-201310-21.xml http://www.debian.org/security/2014/dsa-2891 http://www • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 74EXPL: 0CVE-2013-2032
https://notcve.org/view.php?id=CVE-2013-2032
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks. MediaWiki anteriores a 1.19.6, y 1.20.x anteriores a 1.20.5 no permite a las extensiones prevenir cambios en las contraseñas sin usar Special:PasswordReset y Special:ChangePassword, lo cual permite a atacantes remotos sortear restricciones de acceso en extensiones que sólo implementan uno de estos bloques. • http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html http://secunia.com/advisories/55433 http://security.gentoo.org/glsa/glsa-201310-21.xml https://bugzilla.wikimedia.org/show_bug.cgi?id=46590 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 42%CPEs: 27EXPL: 1CVE-2010-1159 – Aircrack-NG Tools svn r1675 - Remote Heap Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2010-1159
Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet. Múltiples desbordamientos de buffer basados en memoria dinámica en Aircrack-ng anteriores a 1.1 permiten a atacantes remotos causar denegación de servicio (caída) y ejecutar código arbitrario a través de (1) un valor grande en un paquete EAPOL o (2) un paquete EAPOL grande. • https://www.exploit-db.com/exploits/12217 http://pyrit.googlecode.com/svn/tags/opt/aircrackng_exploit.py http://secunia.com/advisories/39150 http://secunia.com/advisories/55053 http://security.gentoo.org/glsa/glsa-201310-06.xml http://svn.aircrack-ng.org/trunk/ChangeLog • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 39EXPL: 0CVE-2012-4893
https://notcve.org/view.php?id=CVE-2012-4893
Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) read files or execute (2) tar, (3) zip, or (4) gzip commands, a different issue than CVE-2012-2982. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en file/show.cgi en Webmin v1.590 y anteriores, permite a atacantes remotos secuestrar la autenticación de usaurios privilegiados para peticiones que (1) leen archivos o ejecutan comandos (2) tar, (3) zip, o (4) gzip, una cuestion diferente de CVE-2012-2982. • http://americaninfosec.com/research/index.html http://www.americaninfosec.com/research/dossiers/AISG-12-001.pdf http://www.kb.cert.org/vuls/id/788478 • CWE-352: Cross-Site Request Forgery (CSRF) •