CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 2CVE-2019-12572
https://notcve.org/view.php?id=CVE-2019-12572
21 Jun 2019 — A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. On startup, the PIA Windows service (pia-service.exe) loads the OpenSSL library from %PROGRAMFILES%\Private Internet Access\libeay32.dll. This library attempts to load the C:\etc\ssl\openssl.cnf configuration file which does not exist. By default on Windows systems, authenticated users can create direct... • https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.3EPSS: 1%CPEs: 55EXPL: 0CVE-2019-10246
https://notcve.org/view.php?id=CVE-2019-10246
22 Apr 2019 — In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories. En Eclipse Jetty versión 9.2.27, versión 9.3.26 y versión 9.4.16 , el servidor que es ejecutado en Windows es vulnerable a la exposición del nombre del... • https://bugs.eclipse.org/bugs/show_bug.cgi?id=546576 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •
CVSS: 7.8EPSS: 1%CPEs: 152EXPL: 0CVE-2018-5391 – The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets
https://notcve.org/view.php?id=CVE-2018-5391
14 Aug 2018 — The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size. El kernel de Linux en versio... • http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.3EPSS: 32%CPEs: 3EXPL: 0CVE-2018-8312
https://notcve.org/view.php?id=CVE-2018-8312
11 Jul 2018 — A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote Code Execution Vulnerability." This affects Microsoft Access, Microsoft Office. Existe una vulnerabilidad de ejecución remota de código cuando Microsoft Access no gestiona correctamente objetos en la memoria. Esto también se conoce como "Microsoft Access Remote Code Execution Vulnerability". Esto afecta a Microsoft Access y Microsoft Office • http://www.securityfocus.com/bid/104645 •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 4CVE-2018-12571 – Microsoft Forefront Unified Access Gateway 2010 External DNS Interaction
https://notcve.org/view.php?id=CVE-2018-12571
02 Jul 2018 — uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or SSRF outcome. uniquesig0/InternalSite/InitParams.aspx en Microsoft Forefront Unified Access Gateway 2010 permite que atacantes remotos desencadenen consultas DNS salientes para hosts arbitrarios mediante una lista de URL separadas por ... • https://packetstorm.news/files/id/148389 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.6EPSS: 46%CPEs: 665EXPL: 7CVE-2018-3639 – AMD / ARM / Intel - Speculative Execution Variant 4 Speculative Store Bypass
https://notcve.org/view.php?id=CVE-2018-3639
21 May 2018 — Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. Los sistemas con microprocesadores que emplean la ejecución especulativa y que realizan la ejecución especulativa de lecturas de memoria antes de que se conozcan las direcciones de todas l... • https://packetstorm.news/files/id/147839 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 7.2EPSS: 6%CPEs: 30EXPL: 2CVE-2018-5511 – VMware Workstation 14.1.5 / VMware Player 15.0.2 - Host VMX Process Impersonation Hijack Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-5511
13 Apr 2018 — On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced. En F5 BIG-IP, de la versión 13.1.0 a la 13.1.0.3 o en la versión 13.0.0, cuando los usuarios administrativos autenticados ejecutan comandos en el TMUI (Traffic Management User Interface), también llamado utilidad BIG-IP Configuration, podrían no aplicarse la... • https://packetstorm.news/files/id/152213 • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 7.8EPSS: 17%CPEs: 4EXPL: 0CVE-2018-0903
https://notcve.org/view.php?id=CVE-2018-0903
14 Mar 2018 — Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability due to how objects are handled in memory, aka "Microsoft Access Remote Code Execution Vulnerability". Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016 y Microsoft Office 2016 Click-to-Run permiten una vulnerabilidad de ejecución remota de código debido a la forma en la que se gestionan los objetos en la memoria. Esto tambié... • http://www.securityfocus.com/bid/103315 •
CVSS: 7.8EPSS: 0%CPEs: 138EXPL: 0CVE-2016-2408
https://notcve.org/view.php?id=CVE-2016-2408
02 Aug 2016 — Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privileges via unspecified vectors. Pulse Secure Desktop anterior a la versión 5.2R2 y Pulse Secure Installer Service anterior a versión 8.2R2 y anteriores para Windows permiten a los usuarios restringidos obtener privilegios a través de vectores no especificados • http://www.securityfocus.com/bid/92692 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-0287
https://notcve.org/view.php?id=CVE-2016-0287
08 Jul 2016 — IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors. IBM i Access 7.1 en Windows permite a usuarios locales descubrir las contraseñas de registro a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=nas8N1021418 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-254: 7PK - Security Features •