CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 2CVE-2020-5202
https://notcve.org/view.php?id=CVE-2020-5202
apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00065.html http://www.openwall.com/lists/oss-security/2020/01/20/4 https://seclists.org/oss-sec/2020/q1/21 https://security-tracker.debian.org/tracker/CVE-2020-5202 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2014-4510
https://notcve.org/view.php?id=CVE-2014-4510
Cross-site scripting (XSS) vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en job.cc en apt-cacher-ng 0.7.26 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://anonscm.debian.org/cgit/apt-cacher-ng/apt-cacher-ng.git/diff/?id=6f08e6a3995d1bed4e837889a3945b6dc650f6ad http://seclists.org/oss-sec/2014/q2/602 http://seclists.org/oss-sec/2014/q2/603 http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-misc/apt-cacher-ng/files/apt-cacher-ng-0.7.26-CVE-2014-4510.patch?view=markup http://www.securityfocus.com/bid/68136 https://bugzilla.redhat.com/show_bug.cgi?id=1111807 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2005-1854
https://notcve.org/view.php?id=CVE-2005-1854
Unknown vulnerability in apt-cacher in Debian 3.1, related to "missing input sanitising," allows remote attackers to execute arbitrary commands on the caching server. Vulnerabilidad desconocida en apt-catcher en Debian 3.1 relacionada con "missing input sanitising", permite que atacantes remotos ejecuten código arbitrario en el servidor donde se cachea. • http://secunia.com/advisories/16327 http://www.debian.org/security/2005/dsa-772 http://www.securityfocus.com/bid/14459 https://exchange.xforce.ibmcloud.com/vulnerabilities/21664 •