CVSS: 8.1EPSS: 1%CPEs: 36EXPL: 0CVE-2016-9014
https://notcve.org/view.php?id=CVE-2016-9014
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. Django en versiones anteriores a 1.8.x en versiones anteriores a 1.8.16, 1.9.x en versiones anteriores a 1.9.11 y 1.10.x en versiones anteriores a 1.10.3 cuando settings.DEBUG es True, permiten a atacantes remotos llevar a cabo ataques de revinculación DNS aprovechando el fallo para validar la cabecera del Host HTTP contra settings.ALLOWED_HOSTS. • http://www.debian.org/security/2017/dsa-3835 http://www.securityfocus.com/bid/94068 http://www.securitytracker.com/id/1037159 http://www.ubuntu.com/usn/USN-3115-1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S https://www.djangoproject.com/weblog/2016/nov/01/security-releases • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 36EXPL: 0CVE-2016-9013
https://notcve.org/view.php?id=CVE-2016-9013
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. Django 1.8.x en versiones anteriores a 1.8.16, 1.9.x en versiones anteriores a 1.9.11 y 1.10.x en versiones anteriores a 1.10.3 utiliza una contraseña embebida para un usuario de base de datos temporal creada al ejecutar pruebas con una base de datos Oracle, lo que hace más fácil a atacantes remotos obtener acceso al servidor de la base de datos aprovechando el fallo para especificar manualmente una contraseña en la configuración del diccionario TEST de la base de datos. • http://www.debian.org/security/2017/dsa-3835 http://www.securityfocus.com/bid/94069 http://www.securitytracker.com/id/1037159 http://www.ubuntu.com/usn/USN-3115-1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S https://www.djangoproject.com/weblog/2016/nov/01/security-releases • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2016-7944
https://notcve.org/view.php?id=CVE-2016-7944
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync. Desbordamiento de entero en X.org libXfixes en versiones anteriores a 5.0.3 en plataformas 32-bit podría permitir a servidores remotos X obtener privilegios a través de un valor de longitud de INT_MAX, que desencadena que el cliente pare la lectura de datos y salga de la sincronización. • http://www.openwall.com/lists/oss-security/2016/10/04/2 http://www.openwall.com/lists/oss-security/2016/10/04/4 http://www.securityfocus.com/bid/93361 http://www.securitytracker.com/id/1036945 https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CE6VJWBMOWLSCH4OP4TAEPIA7NP53ON https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-190: Integer Overflow or Wraparound CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2016-7948
https://notcve.org/view.php?id=CVE-2016-7948
X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data. X.org libXrandr en versiones anteriores a 1.5.1 permite a servidores remotos X desencadenar operaciones de escritura fuera de límites aprovechando el manejo incorrecto de datos de respuesta. • http://www.openwall.com/lists/oss-security/2016/10/04/2 http://www.openwall.com/lists/oss-security/2016/10/04/4 http://www.securityfocus.com/bid/93373 http://www.securitytracker.com/id/1036945 https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74FFOHWYIKQZTJLRJWDMJ4W3WYBELUUG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2016-7952
https://notcve.org/view.php?id=CVE-2016-7952
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data. X.org libXtst en versiones anteriores a 1.2.3 permite a servidores remotos X provocar una denegación de servicio (bucle infinito) a través de una respuesta en la categoría (1) XRecordStartOfData, (2) XRecordEndOfData o (3) XRecordClientDied sin una secuencia cliente y con datos adjuntos. • http://www.openwall.com/lists/oss-security/2016/10/04/2 http://www.openwall.com/lists/oss-security/2016/10/04/4 http://www.securityfocus.com/bid/93375 http://www.securitytracker.com/id/1036945 https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFLHX7WNEUXXDAGR324T35L5P6RRR7GE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R • CWE-20: Improper Input Validation CWE-284: Improper Access Control •