CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-19865
https://notcve.org/view.php?id=CVE-2018-19865
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. Se ha descubierto un problema de registro de pulsaciones del teclado en Virtual Keyboard en Qt, en versiones 5.7.x, 5.8.x, 5.9.x, 5.10.x y versiones 5.11.x anteriores a la 5.11.3. • http://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00085.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00086.html https://codereview.qt-project.org/#/c/243666 https://codereview.qt-project.org/#/c/244569 https://codereview.qt-project.org/#/c/244687 https://codereview.qt-project.org/#/c/244845 https://codereview.qt-project.org/#/c/245283 https&# • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10904
https://notcve.org/view.php?id=CVE-2017-10904
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. Qt para Android en versiones anteriores a la 5.9.0 permite que los atacantes remotos ejecuten comandos de sistema operativo arbitrarios mediante vectores sin especificar. • https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android https://jvn.jp/en/jp/JVN67389262/index.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10905
https://notcve.org/view.php?id=CVE-2017-10905
A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors. Una vulnerabilidad en aplicaciones creadas mediante Qt para Android en versiones anteriores a la 5.9.3 permite que atacantes alteren variables del entorno mediante vectores sin especificar. • https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android https://jvn.jp/en/jp/JVN27342829/index.html •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2017-15011
https://notcve.org/view.php?id=CVE-2017-15011
The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial of service (application crash) via an unspecified string. Las tuberías nombradas en qtsingleapp en QT 5.x, tal y como se usan en qBittorrent y SugarSync, están configuradas para que se puedan acceder de manera remota y permitan que atacantes remotos provoquen una denegación de servicio (cierre inesperado de la aplicación) mediante una cadena no especificada. • https://hackinparis.com/data/slides/2017/2017_Cohen_Gil_The_forgotten_interface_Windows_named_pipes.pdf https://www.youtube.com/watch?v=m6zISgWPGGY • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •