CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35166 – WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 5.6.3 - Sensitive Data Exposure vulnerability
https://notcve.org/view.php?id=CVE-2024-35166
13 May 2024 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through 5.6.3. Exposición de información confidencial a una vulnerabilidad de actor no autorizado en Ninja Team Filebird. Este problema afecta a Filebird: desde n/a hasta 5.6.3. • https://patchstack.com/database/vulnerability/filebird/wordpress-filebird-wordpress-media-library-folders-file-manager-plugin-5-6-3-sensitive-data-exposure-vulnerability?_s_id=cve • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41038 – Server crash when using specific form of SET BIND statement
https://notcve.org/view.php?id=CVE-2023-41038
20 Mar 2024 — Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long `CHAR` length, which causes the server to crash due to stack corruption. Versions 4.0.4.2981 and 5.0.0.117 contain fixes for this issue. No known workarounds are available. • https://firebirdsql.org/en/snapshot-builds • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.0EPSS: 5%CPEs: 5EXPL: 1CVE-2017-11509
https://notcve.org/view.php?id=CVE-2017-11509
28 Mar 2018 — An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement. Un atacante remoto autenticado puede ejecutar código arbitrario en Firebird SQL Server, versiones 2.5.7 y 3.0.2, ejecutando una instrucción SQL mal formada. • https://lists.debian.org/debian-lts-announce/2018/05/msg00005.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-6369 – Ubuntu Security Notice USN-3929-1
https://notcve.org/view.php?id=CVE-2017-6369
24 Mar 2017 — Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so. Verificaciones insuficientes en el subsistema UDF en Firebird 2.5.x en versiones anteriores a 2.5.7 y 3.0.x en versiones anteriores a 3.0.2 permiten a usuarios remotos autenticados ejecutar código utilizando un punto de entrada 'system' desde fbudf.so. It was discovered that Firebird incorrectly handled certain malformed... • http://tracker.firebirdsql.org/browse/CORE-5474 • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-1569
https://notcve.org/view.php?id=CVE-2016-1569
13 Jan 2016 — FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter. FireBird 2.5.5 permite a usuarios autenticados provocar una denegación de servicio (caída de demonio) utilizando el servicio manager para invocar la utilidad gbak con un parámetro no válido. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177119.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 1CVE-2014-9323 – Debian Security Advisory 3109-1
https://notcve.org/view.php?id=CVE-2014-9323
16 Dec 2014 — The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status. La función xdr_status_vector en Firebird anterior a 2.1.7 y 2.5.x anterior a 2.5.3 SU1 permite a atacantes remotos causar una denegación de servicio (referencia a puntero nulo, fallo de segmentación y caída) a través de una acción op_response con un estado 'no vacío'... • http://advisories.mageia.org/MGASA-2014-0523.html • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 68%CPEs: 7EXPL: 4CVE-2013-2492 – Firebird - Relational Database CNCT Group Number Buffer Overflow
https://notcve.org/view.php?id=CVE-2013-2492
15 Mar 2013 — Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information. Desbordamiento de búfer basado en pila en Firebird v2.1.3 hasta v2.1.5 anterior a 18514, y v2.5.1 hasta v2.5.3 anterior a 26623, en Windows permite a atacantes remotos ejecutar código arbitrario a través de pa... • https://www.exploit-db.com/exploits/41709 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2012-5529
https://notcve.org/view.php?id=CVE-2012-5529
20 Nov 2012 — TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query. TraceManager en Firebird v2.5.0 y v2.5.1, cuando el rastreo está habilitado, permite a usuarios remotos autenticados provocar una denegación de servicio (desreferencia puntero NULL y caída) mediante la preparación de una consulta vacía SQL dinámica. • http://tracker.firebirdsql.org/browse/CORE-3884 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 22%CPEs: 17EXPL: 4CVE-2009-2620 – Firebird SQL - op_connect_request main listener shutdown
https://notcve.org/view.php?id=CVE-2009-2620
29 Jul 2009 — src/remote/server.cpp in fbserver.exe in Firebird SQL 1.5 before 1.5.6, 2.0 before 2.0.6, 2.1 before 2.1.3, and 2.5 before 2.5 Beta 2 allows remote attackers to cause a denial of service (daemon crash) via a malformed op_connect_request message that triggers an infinite loop or NULL pointer dereference. src/remote/server.cpp en fbserver.exe en Firebird SQL v1.5 anterior a v1.5.6, v2.0 anterior a v2.0.6, v2.1 anterior a v2.1.3, y v2.5 anterior a v2.5 Beta 2, permite a atacantes remotos provocar una denegació... • https://www.exploit-db.com/exploits/9295 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 94%CPEs: 4EXPL: 1CVE-2008-0387 – Firebird 2.0.3 Relational Database - 'protocol.cpp' XDR Protocol Remote Memory Corruption
https://notcve.org/view.php?id=CVE-2008-0387
29 Jan 2008 — Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) op_receive, (2) op_start, (3) op_start_and_receive, (4) op_send, (5) op_start_and_send, and (6) op_start_send_and_receive XDR requests, which triggers memory corruption. Desbordamiento de entero en Firebird SQL 1.0.3 y versiones anteriores, 1.5.x versiones anteriores a 1.5.6, 2.0.x versiones anteriores a 2.0.4, y 2.1.x v... • https://www.exploit-db.com/exploits/31050 • CWE-189: Numeric Errors •