CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-1400
https://notcve.org/view.php?id=CVE-2014-1400
The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors. La API entity_access en el módulo Entity API, en versiones 7.x-1.x anteriores a la 7.x-1.3 para Drupal, podría permitir que usuarios autenticados remotos omitan las restricciones de acceso planeadas y lean comentarios no publicados mediante vectores sin especificar. • http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html http://www.openwall.com/lists/oss-security/2014/01/09/3 http://www.securityfocus.com/bid/64729 https://bugzilla.redhat.com/show_bug.cgi?id=1050802 https://exchange.xforce.ibmcloud.com/vulnerabilities/90396 https://www.drupal.org/node/2169595 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-1399
https://notcve.org/view.php?id=CVE-2014-1399
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on referenced entities via unspecified vectors. La API de acceso al contenedor de entidad en el módulo Entity API, en versiones 7.x-1.x anteriores a la 7.x-1.3 para Drupal, podría permitir que usuarios autenticados remotos omitan las restricciones de acceso planeadas en las entidades referenciadas mediante vectores sin especificar. • http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html http://www.openwall.com/lists/oss-security/2014/01/09/3 http://www.securityfocus.com/bid/64729 https://bugzilla.redhat.com/show_bug.cgi?id=1050802 https://exchange.xforce.ibmcloud.com/vulnerabilities/90216 https://www.drupal.org/node/2169595 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-1398
https://notcve.org/view.php?id=CVE-2014-1398
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors. La API de acceso al contenedor de entidad en el módulo Entity API, en versiones 7.x-1.x anteriores a la 7.x-1.3 para Drupal, podría permitir que usuarios autenticados remotos omitan las restricciones de acceso planeadas en las propiedades comment, user y node statistics mediante vectores sin especificar. • http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html http://www.openwall.com/lists/oss-security/2014/01/09/3 http://www.securityfocus.com/bid/64729 https://bugzilla.redhat.com/show_bug.cgi?id=1050802 https://exchange.xforce.ibmcloud.com/vulnerabilities/90215 https://www.drupal.org/node/2169595 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 2%CPEs: 43EXPL: 2CVE-2014-3005
https://notcve.org/view.php?id=CVE-2014-3005
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request. Vulnerabilidad XEE (XML External Entity) en Zabbix 1.8.x anteriores a 1.8.21rc1, 2.0.x anteriores a 2.0.13rc1, 2.2.x anteriores a 2.2.5rc1 y 2.3.x anteriores a 2.3.2 permite que los atacantes remotos lean archivos arbitrarios o puedan ejecutar código arbitrario mediante un DTD manipulado en una petición XML. • http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134885.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134909.html http://seclists.org/fulldisclosure/2014/Jun/87 http://www.securityfocus.com/bid/68075 https://bugzilla.redhat.com/show_bug.cgi?id=1110496 https://support.zabbix.com/browse/ZBX-8151 https://web.archive.org/web/20140622034155/http://www.pnigos.com:80/?p=273 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.8EPSS: 0%CPEs: 253EXPL: 0CVE-2016-1238
https://notcve.org/view.php?id=CVE-2016-1238
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL y (25) utils/splain.PL en Perl 5.x en versiones anteriores a 5.22.3-RC2 y 5.24 en versiones anteriores a 5.24.1 1-RC2 no elimina adecuadamente caracteres . (period) del final de la matriz de directorio incluida, lo que podría permitir a usuarios locales obtener privilegios a través de un módulo Troyano bajo el directorio de trabajo actual. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab http://www.debian.org/security/2016/dsa-3628 http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html http://www.securityfocus.com/bid/92136 http://www.securitytracker.com/id/1036440 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731 https://lists.apache.org/thread.html/7f6a16bc0fd0fd5 • CWE-264: Permissions, Privileges, and Access Controls •