Page 78 of 700 results (0.013 seconds)

CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 2

CVE-2015-5957

https://notcve.org/view.php?id=CVE-2015-5957

Buffer overflow in the DumpSysVar function in var.c in Remind before 3.1.15 allows attackers to have unspecified impact via a long name. Desbordamiento de buffer en la función DumpSysVar en var.c en Remind en versiones anteriores a 3.1.15, permite a atacantes tener un impacto no especificado a través de un nombre largo. • http://lists.opensuse.org/opensuse-updates/2015-09/msg00025.html http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html http://www.openwall.com/lists/oss-security/2015/07/29/2 http://www.openwall.com/lists/oss-security/2015/08/07/1 http://www.securityfocus.com/bid/76099 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 5.0EPSS: 2%CPEs: 4EXPL: 1

CVE-2015-5185

https://notcve.org/view.php?id=CVE-2015-5185

The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty className in a packet. Vulnerabilidad en la función lookupProviders en providerMgr.c en sblim-sfcb 1.3.4 y 1.3.18, permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída de la aplicación) a través de un className vacío en un paquete. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172634.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172659.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172667.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00019.html http://www.openwall.com/lists/oss-security/2015/08/21/2 http://www.securityfocus.com/bid/91212 •

CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 2

CVE-2015-6938

https://notcve.org/view.php?id=CVE-2015-6938

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate. Vulnerabilidad de XSS en el buscador de archivos en notebook/notebookapp.py en IPython Notebook en versiones anteriores a 3.2.2 y Jupyter Notebook 4.0.x en versiones anteriores a 4.0.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del nombre de una carpeta. NOTA: esta vulnerabilidad fue inicialmente reportada como (CSRF), pero esto puede ser incorrecto. • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166460.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166471.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html http://lists.opensuse.org/opensuse-updates/2015-10/msg00016.html http://seclists.org/oss-sec/2015/q3/474 http://seclists.org/oss-sec/2015/q3/544 https://bugzilla.redhat.com/show_bug.cgi?id=1259405 https://github.com/ipython/ipython/commit/3a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-9744

https://notcve.org/view.php?id=CVE-2014-9744

Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions. Vulnerabilidad de fuga de memoria en PolarSSL en versiones anteriores a 1.3.9, permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de una gran cantidad de mensajes CLientHello. NOTA: este identificador ha sido SEPARADO de CVE-2014-8628 por ADT3 debido a las diferentes versiones afectadas. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released • CWE-399: Resource Management Errors •

CVSS: 3.3EPSS: 0%CPEs: 9EXPL: 1

CVE-2015-4481 – Mozilla - Maintenance Service Log File Overwrite Privilege Escalation

https://notcve.org/view.php?id=CVE-2015-4481

Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update. Vulnerabilidad de condición de carrera en el Servicio de Mantenimiento de Mozilla en Mozilla Firefox en versiones anteriores a 40.0 y Firefox ESR 38.x en versiones anteriores a 38.2 en Windows, permite a usuarios locales escribir en archivos arbitrarios y consecuentemente obtener privilegios a través de vectores que involucran un enlace duro en un archivo de registro durante una actualización. The maintenance service creates a log file in a user writable location. It's possible to change the log file to a hardlink to another file to cause file corruption or elevation of privilege. • https://www.exploit-db.com/exploits/37925 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00030.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00031.html http://www.mozilla.org/security/announce/2015/mfsa2015-84.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/10 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •