CVSS: 7.8EPSS: 11%CPEs: 7EXPL: 1CVE-2014-9402 – glibc: denial of service in getnetbyname function
https://notcve.org/view.php?id=CVE-2014-9402
The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process. La implementación nss_dns de getnetbyname en GNU C Library (también conocido como glibc) anterior a 2.21, cuando el backend DNS en la configuración Name Service Switch está habilitado, permite a atacantes remotos causar una denegación de servicio (bucle infinito) mediante el envió de una respuesta positiva mientras el nombre de una red está siendo procesada. Many Cisco devices such as Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P, Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160, and Cisco 160W suffer from having hard-coded credentials, known GNU glibc, known BusyBox, and IoT Inspector identified vulnerabilities. • http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html http://seclists.org/fulldisclosure/2019/Jun/18 http://seclists.org/fulldisclosure/2019/Sep/7 http://www.openwall.com/lists/oss-security/2014/12/18/1 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628&# • CWE-399: Resource Management Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.8EPSS: 1%CPEs: 9EXPL: 0CVE-2014-9679 – cups: cupsRasterReadPixels buffer overflow
https://notcve.org/view.php?id=CVE-2014-9679
Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote attackers to have unspecified impact via a malformed compressed raster file, which triggers a buffer overflow. Desbordamiento de enteros en la función cupsRasterReadPixels en filter/raster.c en CUPS anterior a 2.0.2 permite a atacantes remotos tener un impacto no especificado a través de un fichero de raster comprimido malformado, lo que provoca un desbordamiento de buffer. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way CUPS handled compressed raster image files. An attacker could create a specially crafted image file that, when passed via the CUPS Raster filter, could cause the CUPS filter to crash. • http://advisories.mageia.org/MGASA-2015-0067.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150171.html http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150177.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00098.html http://rhn.redhat.com/errata/RHSA-2015-1123.html http://www.debian.org/security/2015/dsa-3172 http://www.mandriva.com/security/advisories?name=MDVSA-2015:049 http://www.mandriva.com/security/advisories?name=MDVSA-201 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2013-2027
https://notcve.org/view.php?id=CVE-2013-2027
Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors. Jython 2.2.1 utiliza el uses el desenmascar actual para configurar los privilegios de los ficheros del caché de clases, lo que permite a usuarios locales evadir las restricciones de acceso a través de vectores no especificados. • http://advisories.mageia.org/MGASA-2015-0096.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00055.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:158 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html https://bugzilla.redhat.com/show_bug.cgi?id=947949 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 1.9EPSS: 0%CPEs: 50EXPL: 0CVE-2015-0245
https://notcve.org/view.php?id=CVE-2015-0245
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. D-Bus 1.4.x hasta 1.6.x anterior a 1.6.30, 1.8.x anterior a 1.8.16, y 1.9.x anterior a 1.9.10 no valida la fuente de los señales ActivationFailure, lo que permite a usuarios locales causar una denegación de servicio (retorno del error del fallo de activación) mediante el aprovechamiento de una condición de carrera que involucra el envío de un señal ActivationFailure antes de que systemd responda. • http://advisories.mageia.org/MGASA-2015-0071.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html http://www.debian.org/security/2015/dsa-3161 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2015/02/09/6 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.4EPSS: 2%CPEs: 5EXPL: 2CVE-2014-9512
https://notcve.org/view.php?id=CVE-2014-9512
rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path. rsync 3.1.1 permite a atacantes remotos escribir a ficheros arbitrarios a través de un ataque de enlace simbólico sobre un fichero en la ruta de sincronización. • http://lists.opensuse.org/opensuse-updates/2015-02/msg00041.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00095.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00112.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.securityfocus.com/bid/76093 http://www.securitytracker.com/id/1034786 http://www.ubuntu.com/usn/USN-2879-1 http://xteam.baidu.com/?p=169 https://bugzilla.samba.org/show_bug.cgi?id=10977 https: • CWE-59: Improper Link Resolution Before File Access ('Link Following') •