CVSS: 9.8EPSS: 0%CPEs: 75EXPL: 0CVE-2014-0179 – libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read
https://notcve.org/view.php?id=CVE-2014-0179
19 May 2014 — libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods. libvirt 0.7.5 hasta 1.2.x anterior ... • http://libvirt.org/news.html • CWE-20: Improper Input Validation CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 1%CPEs: 43EXPL: 0CVE-2014-3730 – Debian Security Advisory 2934-1
https://notcve.org/view.php?id=CVE-2014-3730
16 May 2014 — The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." La función django.util.http.is_safe_url en Django 1.4 anterior a 1.4.13, 1.5 anterior a 1.5.8, 1.6 anterior a 1.6.5 y 1.7 anterior a 1.7b4 no valida debidamente URLs, lo que permite a atacantes remotos realizar ataques ... • http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2014-1909
https://notcve.org/view.php?id=CVE-2014-1909
14 May 2014 — Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow. Error de signo de enteros en system/core/adb/adb_client.c en Android Debug Bridge (ADB) para Android 4.4 en las herramientas de plataforma de Android SDK 18.0.1 permite a servidores ADB ejecutar código arbitrario a ... • http://lists.opensuse.org/opensuse-updates/2014-05/msg00038.html • CWE-189: Numeric Errors •
CVSS: 4.4EPSS: 0%CPEs: 29EXPL: 0CVE-2014-1934
https://notcve.org/view.php?id=CVE-2014-1934
08 May 2014 — tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file. tag.py en eyeD3 (también conocido como python-eyed3) 7.0.3, 0.6.18 y anteriores para Python permite a usuarios locales modificar archivos arbitrarios a través de un ataque de enlace simbólico sobre un archivo temporal. • http://lists.opensuse.org/opensuse-updates/2014-05/msg00027.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 16%CPEs: 4EXPL: 5CVE-2014-2913 – NRPE 2.15 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-2913
07 May 2014 — Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments... • https://packetstorm.news/files/id/128038 •
CVSS: 7.5EPSS: 30%CPEs: 13EXPL: 0CVE-2014-0198 – openssl: SSL_MODE_RELEASE_BUFFERS NULL pointer dereference in do_ssl3_write()
https://notcve.org/view.php?id=CVE-2014-0198
05 May 2014 — The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition. La función do_ssl3_write en s3_pkt.c en OpenSSL 1.x hasta 1.0.1g, cuando SSL_MODE_RELEASE_BUFFERS está habilitado, no maneja debidamente un puntero de buffer durante ciertas... • http://advisories.mageia.org/MGASA-2014-0204.html • CWE-476: NULL Pointer Dereference •
CVSS: 9.3EPSS: 1%CPEs: 9EXPL: 0CVE-2014-1525 – Ubuntu Security Notice USN-2185-1
https://notcve.org/view.php?id=CVE-2014-1525
29 Apr 2014 — The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. La función mozilla::dom::TextTrack::AddCue en Mozilla Firefox anterior a 29.0 y SeaMonkey anterior a 2.26 no realiza debidamente la recogida de basura pa... • http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 9EXPL: 0CVE-2014-1526 – Ubuntu Security Notice USN-2185-1
https://notcve.org/view.php?id=CVE-2014-1526
29 Apr 2014 — The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. La implemenatción XrayWrapper en Mozilla Firefox anterior a 29.0 y SeaMonkey anterior a 2.26 permite a atacantes remotos asistidos por un usuario, evadir restricciones de acceso a creando un sitio web manipu... • http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 1%CPEs: 11EXPL: 0CVE-2014-1528 – Ubuntu Security Notice USN-2185-1
https://notcve.org/view.php?id=CVE-2014-1528
29 Apr 2014 — The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element. La función sse2_composite_src_x888_8888 en Pixman, utilizad o en Cairo en Mozilla Firefox 28.0 y SeaMonkey 2.25 en Windows, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (escritura fuera... • http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 0%CPEs: 27EXPL: 1CVE-2014-1529 – Mozilla: Privilege escalation through Web Notification API (MFSA 2014-42)
https://notcve.org/view.php?id=CVE-2014-1529
29 Apr 2014 — The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. La API Web Notification en Mozilla Firefox anterior a 29.0, Firefox ESR 24.x anterior a 24.5, Thunderbird anterior a 24.5 y SeaMonkey anterior a 2.26 permite a atacantes ... • http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.html • CWE-269: Improper Privilege Management •