CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-3409
https://notcve.org/view.php?id=CVE-2012-3409
ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation ecryptfs-utils: el asistente suid no restringe el montaje de sistemas de archivos con nosuid,nodev lo que genera una posible escalada de privilegios • http://www.openwall.com/lists/oss-security/2012/07/11/23 http://www.openwall.com/lists/oss-security/2012/07/12/1 http://www.openwall.com/lists/oss-security/2012/07/13/5 https://access.redhat.com/security/cve/cve-2012-3409 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3409 https://security-tracker.debian.org/tracker/CVE-2012-3409 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2019-3467
https://notcve.org/view.php?id=CVE-2019-3467
Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals. Debian-edu-config todas las versiones anteriores a la versión 2.11.10, un conjunto de archivos de configuración utilizados para Debian Edu y debian-lan-config anterior a la versión 0.26, configuraron ACL demasiado permisivas para el servidor de Kerberos, lo que permitió cambios de contraseña para otros principales usuarios de Kerberos . • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946797 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947459 https://lists.debian.org/debian-lts-announce/2019/12/msg00023.html https://lists.debian.org/debian-lts-announce/2020/01/msg00012.html https://seclists.org/bugtraq/2019/Dec/34 https://seclists.org/bugtraq/2019/Dec/44 https://security-tracker.debian.org/tracker/CVE-2019-3467 https://usn.ubuntu.com/4530-1 https://www.debian.org/security/2019/dsa-4589 http • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 0%CPEs: 55EXPL: 1CVE-2019-19906 – cyrus-sasl: denial of service in _sasl_add_string function
https://notcve.org/view.php?id=CVE-2019-19906
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl. cyrus-sasl (también se conoce como Cyrus SASL) versión 2.1.27, presenta una escritura fuera de límites conllevando a una denegación de servicio remota no autenticada en OpenLDAP por medio de un paquete LDAP malformado. El bloqueo de OpenLDAP es causado en última instancia por un error por un paso en la función _sasl_add_string en el archivo common.c en cyrus-sasl. • http://seclists.org/fulldisclosure/2020/Jul/23 http://seclists.org/fulldisclosure/2020/Jul/24 http://www.openwall.com/lists/oss-security/2022/02/23/4 https://github.com/cyrusimap/cyrus-sasl/issues/587 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.debian.org/debian-lts-announce/2019/12/msg00027.h • CWE-193: Off-by-one Error CWE-400: Uncontrolled Resource Consumption CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16779 – In RubyGem excon, interrupted Persistent Connections May Leak Response Data
https://notcve.org/view.php?id=CVE-2019-16779
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this. En RubyGem excon versiones anteriores a 0.71.0, se presentó una condición de carrera alrededor de conexiones persistentes, donde una conexión que es interrumpida (tal y como, mediante un tiempo de espera) dejaría datos en el socket. Las peticiones posteriores entonces leerían estos datos y devolverían el contenido de la respuesta anterior. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29 https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-664: Improper Control of a Resource Through its Lifetime •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2014-8650
https://notcve.org/view.php?id=CVE-2014-8650
python-requests-Kerberos through 0.5 does not handle mutual authentication python-request-Kerberos versiones hasta la versión 0.5, no maneja una autenticación mutua. • http://www.openwall.com/lists/oss-security/2014/11/07/1 http://www.securityfocus.com/bid/70909 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8650 https://security-tracker.debian.org/tracker/CVE-2014-8650 • CWE-287: Improper Authentication •