CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 1CVE-2022-0571 – Cross-site Scripting (XSS) - Reflected in phoronix-test-suite/phoronix-test-suite
https://notcve.org/view.php?id=CVE-2022-0571
13 Feb 2022 — Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2. Una vulnerabilidad de tipo Cross-site Scripting (XSS) - Reflejado en el repositorio de GitHub phoronix-test-suite/phoronix-test-suite versiones anteriores a 10.8.2 • https://github.com/phoronix-test-suite/phoronix-test-suite/commit/1eac9260c8313f0cfc77837ec676f4e6d68bd833 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 14EXPL: 0CVE-2021-45079 – Gentoo Linux Security Advisory 202405-08
https://notcve.org/view.php?id=CVE-2021-45079
25 Jan 2022 — In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication. En strongSwan versiones anteriores a 5.9.5, un respondedor malicioso puede enviar un mensaje EAP-Success demasiado pronto sin autenticar realmente al cliente y (en el caso de los métodos EAP con autenticación mutua y autenticación sólo EAP par... • https://www.strongswan.org/blog/2022/01/24/strongswan-vulnerability-%28cve-2021-45079%29.html • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 2CVE-2021-46141 – Debian Security Advisory 5063-1
https://notcve.org/view.php?id=CVE-2021-46141
06 Jan 2022 — An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner. Se ha detectado un problema en uriparser versiones anteriores a 0.9.6. Lleva a cabo operaciones inválidas en uriFreeUriMembers y uriMakeOwner. Two vulnerabilities were discovered in uriparser, a library that parses Uniform Resource Identifiers (URIs), which may result in denial of service or potentially in the the execution of arbitrary code. • https://blog.hartwork.org/posts/uriparser-096-with-security-fixes-released • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 2CVE-2021-46142 – Debian Security Advisory 5063-1
https://notcve.org/view.php?id=CVE-2021-46142
06 Jan 2022 — An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. Se ha detectado un problema en uriparser versiones anteriores a 0.9.6. Lleva a cabo operaciones libres no válidas en uriNormalizeSyntax. Two vulnerabilities were discovered in uriparser, a library that parses Uniform Resource Identifiers (URIs), which may result in denial of service or potentially in the the execution of arbitrary code. • https://blog.hartwork.org/posts/uriparser-096-with-security-fixes-released • CWE-416: Use After Free •
CVSS: 7.5EPSS: 2%CPEs: 3EXPL: 1CVE-2021-23727 – Stored Command Injection
https://notcve.org/view.php?id=CVE-2021-23727
29 Dec 2021 — This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. Esto afecta al paquete celery versiones anteriores a 5.2.2. • https://github.com/celery/celery/blob/master/Changelog.rst%23522 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43560
https://notcve.org/view.php?id=CVE-2021-43560
22 Nov 2021 — A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events. Se ha encontrado un fallo en Moodle en versiones 3.11 hasta 3.11.3, versiones 3.10 hasta 3.10.7, versiones 3.9 hasta 3.9.10 y versiones anteriores no soportadas. Las comprobaciones de capacidad insuficientes permitían conseguir los eventos de acción del calendario de otros usuarios • https://bugzilla.redhat.com/show_bug.cgi?id=2021519 • CWE-668: Exposure of Resource to Wrong Sphere CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43559
https://notcve.org/view.php?id=CVE-2021-43559
22 Nov 2021 — A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk. Se encontró un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. La funcionalidad "delete related badge" no incluía la comprobación de tokens necesaria para evitar un riesgo de tipo CSRF • https://bugzilla.redhat.com/show_bug.cgi?id=2021517 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43558
https://notcve.org/view.php?id=CVE-2021-43558
22 Nov 2021 — A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk. Se encontró un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. Un parámetro de URL en la herramienta de administración del sitio filetype requería un saneamiento adicional para evitar un riesgo de un ataque de tipo X... • https://bugzilla.redhat.com/show_bug.cgi?id=2021515 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 1CVE-2021-3733 – python: urllib: Regular expression DoS in AbstractBasicAuthHandler
https://notcve.org/view.php?id=CVE-2021-3733
17 Sep 2021 — There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. Se presenta un fallo en la clase AbstractBasicAuthHandler de urllib. Un atacante que controle un servidor H... • https://bugs.python.org/issue43075 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 1CVE-2021-21897 – openSUSE Security Advisory - openSUSE-SU-2022:0134-1
https://notcve.org/view.php?id=CVE-2021-21897
08 Sep 2021 — A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Se presenta una vulnerabilidad de ejecución de código en la funcionalidad DL_Dxf::handleLWPolylineData de Ribbonsoft dxflib versión 3.17.0. Un archivo .dxf especialmente diseñado puede conllevar a un desbordamiento del búfer de la pila. • https://lists.debian.org/debian-lts-announce/2022/06/msg00008.html • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-787: Out-of-bounds Write •