CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14312
https://notcve.org/view.php?id=CVE-2020-14312
05 Feb 2021 — A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against ot... • https://bugzilla.redhat.com/show_bug.cgi?id=1851342 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 2%CPEs: 3EXPL: 3CVE-2015-4410
https://notcve.org/view.php?id=CVE-2015-4410
20 Feb 2020 — The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string. El método Moped::BSON::ObjecId.legal? en rubygem-moped antes del commit dd5a7c14b5d2e466f7875d079af71ad19774609b, permite a atacantes remotos causar una denegación de servicio (consumo de recursos de worker) o llevar a cabo un ataque de tipo cross-s... • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 3%CPEs: 3EXPL: 2CVE-2015-4411
https://notcve.org/view.php?id=CVE-2015-4411
20 Feb 2020 — The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410. El método Moped::BSON::ObjecId.legal? en mongodb/bson-ruby, versiones anteriores a 3.0.4, como es usado en rubygem-moped, permite a atacantes remotos causar una denegación de servicio (consumo de recursos de worker) por medio de una cadena diseña... • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 3%CPEs: 4EXPL: 0CVE-2010-5304
https://notcve.org/view.php?id=CVE-2010-5304
05 Feb 2020 — A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client. Se encontró un fallo de desreferencia del puntero NULL en la manera en que LibVNCServer versiones anteriores a 0.9.9 manejaba determinado mensaje de ClientCutText. Un atacante remoto podría utilizar este fallo para bloquear el servidor VNC mediante el envío de... • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139654.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 1CVE-2015-2793
https://notcve.org/view.php?id=CVE-2015-2793
21 Nov 2019 — Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo templates/openid-selector.tmpl en ikiwiki versiones anteriores a 3.20150329, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro openid_identifier en una acción de comp... • http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 12%CPEs: 10EXPL: 1CVE-2013-5123 – phlyLabs phlyMail Lite 4.03.04 - 'go' Open Redirect
https://notcve.org/view.php?id=CVE-2013-5123
05 Nov 2019 — The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. El soporte de duplicación (-M, --use-mirrors) en Python Pip versiones anteriores a la versión 1.5, utiliza consultas DNS no seguras y comprobaciones de autenticidad que permiten a atacantes realizar ataques de tipo man-in-the-middle. • https://www.exploit-db.com/exploits/24086 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-7271
https://notcve.org/view.php?id=CVE-2014-7271
08 Mar 2018 — Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication. Simple Desktop Display Manager (SDDM) en versiones anteriores a la 0.10.0 permite que los usuarios locales inicien sesión como usuario "sddm" sin autenticación. • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141494.html • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-7272
https://notcve.org/view.php?id=CVE-2014-7272
08 Mar 2018 — Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases). Simple Desktop Display Manager (SDDM), en versiones anteriores a la 0.10.0, permite que los usuarios locales obtengan privilegios root, ya que la ejecución de código como ro... • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141494.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-8008
https://notcve.org/view.php?id=CVE-2015-8008
29 Dec 2017 — The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token. La extensión OAuth para MediaWiki negocia incorrectamente un nuevo token de cliente solo en Special:OAuth/initiate. Esto permite que atacantes omitan las restricciones de dirección IP planeadas elaborando una petición API con un token existente. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170961.html • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 11%CPEs: 16EXPL: 0CVE-2015-5739 – golang: HTTP request smuggling in net/http library
https://notcve.org/view.php?id=CVE-2015-5739
18 Oct 2017 — The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length." La biblioteca net/http en net/textproto/reader.go en Go en versiones anteriores a la 1.4.3 no analiza sintácticamente claves de cabecera HTTP correctamente, lo que permite que atacantes remotos lleven a cabo ataques de contrabando de... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •