CVSS: 7.5EPSS: 0%CPEs: 55EXPL: 1CVE-2019-19906 – cyrus-sasl: denial of service in _sasl_add_string function
https://notcve.org/view.php?id=CVE-2019-19906
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl. cyrus-sasl (también se conoce como Cyrus SASL) versión 2.1.27, presenta una escritura fuera de límites conllevando a una denegación de servicio remota no autenticada en OpenLDAP por medio de un paquete LDAP malformado. El bloqueo de OpenLDAP es causado en última instancia por un error por un paso en la función _sasl_add_string en el archivo common.c en cyrus-sasl. • http://seclists.org/fulldisclosure/2020/Jul/23 http://seclists.org/fulldisclosure/2020/Jul/24 http://www.openwall.com/lists/oss-security/2022/02/23/4 https://github.com/cyrusimap/cyrus-sasl/issues/587 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.debian.org/debian-lts-announce/2019/12/msg00027.h • CWE-193: Off-by-one Error CWE-400: Uncontrolled Resource Consumption CWE-787: Out-of-bounds Write •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16779 – In RubyGem excon, interrupted Persistent Connections May Leak Response Data
https://notcve.org/view.php?id=CVE-2019-16779
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this. En RubyGem excon versiones anteriores a 0.71.0, se presentó una condición de carrera alrededor de conexiones persistentes, donde una conexión que es interrumpida (tal y como, mediante un tiempo de espera) dejaría datos en el socket. Las peticiones posteriores entonces leerían estos datos y devolverían el contenido de la respuesta anterior. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29 https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9 https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-664: Improper Control of a Resource Through its Lifetime •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2014-8650
https://notcve.org/view.php?id=CVE-2014-8650
python-requests-Kerberos through 0.5 does not handle mutual authentication python-request-Kerberos versiones hasta la versión 0.5, no maneja una autenticación mutua. • http://www.openwall.com/lists/oss-security/2014/11/07/1 http://www.securityfocus.com/bid/70909 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8650 https://security-tracker.debian.org/tracker/CVE-2014-8650 • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 0CVE-2014-4913
https://notcve.org/view.php?id=CVE-2014-4913
ZF2014-03 has a potential cross site scripting vector in multiple view helpers ZF2014-03, tiene un vector potencial de tipo cross site scripting en múltiples asistentes de vista. • http://www.openwall.com/lists/oss-security/2014/07/11/4 http://www.securityfocus.com/bid/66971 https://access.redhat.com/security/cve/cve-2014-4913 https://framework.zend.com/security/advisory/ZF2014-03 https://security-tracker.debian.org/tracker/CVE-2014-4913 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2014-3495
https://notcve.org/view.php?id=CVE-2014-3495
duplicity 0.6.24 has improper verification of SSL certificates duplicity versión 0.6.24, presenta una comprobación inapropiada de los certificados SSL. • https://access.redhat.com/security/cve/cve-2014-3495 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3495 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-3495 https://security-tracker.debian.org/tracker/CVE-2014-3495 • CWE-295: Improper Certificate Validation •