CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14312
https://notcve.org/view.php?id=CVE-2020-14312
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems. Se encontró un fallo en la configuración predeterminada de dnsmasq, como es enviado con Fedora versiones anteriores a 31 y en todas las versiones de Red Hat Enterprise Linux, donde escucha en cualquier interfaz y acepta consultas de direcciones fuera de su subred local. • https://bugzilla.redhat.com/show_bug.cgi?id=1851342 • CWE-284: Improper Access Control •
CVSS: 2.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-4980
https://notcve.org/view.php?id=CVE-2016-4980
A password generation weakness exists in xquest through 2016-06-13. Existe una debilidad de generación de contraseña en xquest hasta 13-06-2016. • https://access.redhat.com/security/cve/cve-2016-4980 https://bugzilla.redhat.com/show_bug.cgi?id=1346016 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4980 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVW2QJFNZUZYBN4M4YUE7S2NZBWWMGES • CWE-330: Use of Insufficiently Random Values •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-8008
https://notcve.org/view.php?id=CVE-2015-8008
The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token. La extensión OAuth para MediaWiki negocia incorrectamente un nuevo token de cliente solo en Special:OAuth/initiate. Esto permite que atacantes omitan las restricciones de dirección IP planeadas elaborando una petición API con un token existente. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170961.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170979.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171007.html http://www.openwall.com/lists/oss-security/2015/10/29/14 http://www.securityfocus.com/bid/77379 http://www.securitytracker.com/id/1034028 https://bugzilla.redhat.com/show_bug.cgi?id=1273353 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2015-7687
https://notcve.org/view.php?id=CVE-2015-7687
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta. Uso de memoria previamente liberada en OpenSMTPD en versiones anteriores a la 5.7.2 permite que atacantes remotos provoquen una denegación de servicio (cierre inesperado) o que ejecuten código arbitrario mediante vectores relacionados con req_ca_vrfy_smtp y req_ca_vrfy_mta. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169600.html http://www.openwall.com/lists/oss-security/2015/10/03/1 http://www.securityfocus.com/bid/76975 https://bugzilla.redhat.com/show_bug.cgi?id=1268793 https://www.opensmtpd.org/announces/release-5.7.2.txt https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5258
https://notcve.org/view.php?id=CVE-2015-5258
Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3. Existe una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en springframework-social en versiones anteriores a la 1.1.3. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177420.html https://bugzilla.redhat.com/show_bug.cgi?id=1305443 • CWE-352: Cross-Site Request Forgery (CSRF) •