CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2012-4524 – Gentoo Linux Security Advisory 201309-03
https://notcve.org/view.php?id=CVE-2012-4524
02 Sep 2013 — xlockmore before 5.43 'dclock' security bypass vulnerability xlockmore versiones anteriores a 5.43, se presenta una vulnerabilidad de omisión de seguridad de "dclock". A buffer overflow in Xlockmore might allow remote attackers to cause a Denial of Service. Versions less than 5.43 are affected. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091108.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2013-1888 – Gentoo Linux Security Advisory 201309-05
https://notcve.org/view.php?id=CVE-2013-1888
16 Aug 2013 — pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory. pip anterior a v1.3 permite a los usuarios locales sobrescribir archivos arbitrarios a través de un ataque de enlace simbólico de un archivo en el directorio temporal /tmp/pip-build. Multiple vulnerabilities have been found in pip, which may allow remote attackers to execute arbitrary code or local attackers to conduct symlink attacks. Versions less than 1.3.1 are affected... • http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105952.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 23%CPEs: 23EXPL: 0CVE-2002-2443 – krb5: UDP ping-pong flaw in kpasswd
https://notcve.org/view.php?id=CVE-2002-2443
21 May 2013 — schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. schpw.c en el servicio kpasswd en kadmind en MIT Kerberos 5 (conocido como krb5) anterior a v1.11.3 no valida correctamente los paquetes UDP an... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7637 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2013-0211 – Gentoo Linux Security Advisory 201406-02
https://notcve.org/view.php?id=CVE-2013-0211
19 Apr 2013 — Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow. Error de signo de enteros en la función archive_write_zip_data de archive_write_set_format_zip.c en la versión 3.1.2 y anteriores, cuando se ejecuta... • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101687.html • CWE-189: Numeric Errors •
CVSS: 6.5EPSS: 2%CPEs: 12EXPL: 0CVE-2013-1416 – krb5: NULL pointer dereference (DoS, KDC crash) by processing certain TGS requests
https://notcve.org/view.php?id=CVE-2013-1416
16 Apr 2013 — The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request. La función prep_reprocess_req en do_tgs_req.c en el Key Distribution Center (KDC) en MIT Kerberos 5 (aka krb5) antes de v1.10.5 no realiza correctamente el servicio ámbito de refer... • http://krbdev.mit.edu/rt/Ticket/Display.html?id=7600 • CWE-476: NULL Pointer Dereference •
CVSS: 9.1EPSS: 4%CPEs: 9EXPL: 0CVE-2013-1915 – Mandriva Linux Security Advisory 2013-156
https://notcve.org/view.php?id=CVE-2013-1915
11 Apr 2013 — ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability. ModSecurity antes de v2.7.3 permite a atacantes remotos leer archivos arbitrarios, enviar peticiones HTTP a los servidores de la intranet, o causar una denegación de servicio (consumo de CPU y memoria) a través d... • http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 0%CPEs: 103EXPL: 0CVE-2013-1830
https://notcve.org/view.php?id=CVE-2013-1830
25 Mar 2013 — user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search. user/view.php en Moodle hasta v2.1.10, v2.2.x anterior a v2.2.8, v2.3.x anterior a v2.3.5, y v2.4.x anterior a 2.4.2 no aplica el ajuste forceloginforprofiles, que permite a atacantes remotos obtener información de... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37481 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 20%CPEs: 18EXPL: 0CVE-2013-0170 – libvirt: use-after-free in virNetMessageFree()
https://notcve.org/view.php?id=CVE-2013-0170
29 Jan 2013 — Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue. Vulnerabilidad de uso después de liberación en la función virNetMessageFree en rpc/l... • http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=46532e3e8ed5f5a736a02f67d6c805492f9ca720 • CWE-416: Use After Free •
CVSS: 6.4EPSS: 0%CPEs: 89EXPL: 1CVE-2013-0237 – WordPress Core < 3.5.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2013-0237
24 Jan 2013 — Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. Vulnerabilidad de ejecución de comandos en sitios cruzados en Plupload.as en Moxiecode Plupload anteriores a v1.5.5, como el usado en WordPress anteriores a v3.5.1 y otros productos, permiten a atacantes remotos inyectar comandos web o HTML a través del parámetro id. • http://codex.wordpress.org/Version_3.5.1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 2CVE-2012-5656 – Ubuntu Security Notice USN-1712-1
https://notcve.org/view.php?id=CVE-2012-5656
18 Jan 2013 — The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack. El proceso de rasterización en Inkscape antes de v0.48.4 permite a los usuarios locales leer archivos de su elección a través de entidades externas en un archivo SVG. Se trata de un ataque también conocido como ataque de inyección XML a una entidad externa (XXE). It was discovered that Inkscape incorrectly handled XML external... • http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931 • CWE-611: Improper Restriction of XML External Entity Reference •