CVSS: 6.8EPSS: 1%CPEs: 14EXPL: 0CVE-2015-2296 – Mandriva Linux Security Advisory 2015-133
https://notcve.org/view.php?id=CVE-2015-2296
16 Mar 2015 — The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. La función resolve_redirects en sessions.py en requests 2.1.0 hasta 2.5.3 permite a atacantes remotos realizar ataques de fijación de sesión a través de una cookie sin valor de anfitrión en una redirección. Python-requests was found to have a vulnerability, where the attacker can retrieve the passwords from ~/.netrc file th... • http://advisories.mageia.org/MGASA-2015-0120.html •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2015-2188 – wireshark: The WCP dissector could crash while decompressing data (wnpa-sec-2015-07)
https://notcve.org/view.php?id=CVE-2015-2188
08 Mar 2015 — epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression. epan/dissectors/packet-wcp.c en el disector WCP en Wireshark 1.10.x anterior a 1.10.13 y 1.12.x anterior a 1.12.4 no inicializa correctamente una estructura de datos, lo que permite a... • http://advisories.mageia.org/MGASA-2015-0117.html • CWE-19: Data Processing Errors CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2015-2189 – wireshark: The pcapng file parser could crash (wnpa-sec-2015-08)
https://notcve.org/view.php?id=CVE-2015-2189
08 Mar 2015 — Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. Error de superación de límite (off-by-one) en la función pcapng_read en wiretap/pcapng.c en el analizador sintáctico pcapng en Wireshark 1.10.x anterior a 1.10.13 y 1.12.x anterior a ... • http://advisories.mageia.org/MGASA-2015-0117.html • CWE-189: Numeric Errors CWE-193: Off-by-one Error •
CVSS: 7.5EPSS: 3%CPEs: 22EXPL: 0CVE-2015-2191 – wireshark: The TNEF dissector could go into an infinite loop on 32-bit architectures (wnpa-sec-2015-10)
https://notcve.org/view.php?id=CVE-2015-2191
08 Mar 2015 — Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. Desbordamiento de enteros en la función dissect_tnef en epan/dissectors/packet-tnef.c en el disector TNEF en Wireshark 1.10.x anterior a 1.10.13 y 1.12.x anterior a 1.12.4 permite a atacantes remotos causar una denegación de servicio (bucle i... • http://advisories.mageia.org/MGASA-2015-0117.html • CWE-189: Numeric Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2014-9637 – Mandriva Linux Security Advisory 2015-138
https://notcve.org/view.php?id=CVE-2014-9637
02 Mar 2015 — GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation fault) via a crafted diff file. GNU parche 2.7.2 y anteriores permite que atacantes remotos provoquen una denegación de servicio (consumo de memoria y error de segmentación) mediante un archivo diff manipulado. Jakub Wilk discovered that GNU patch did not correctly handle file paths in patch files. An attacker could specially craft a patch file that could overwrite arbitrary files with the p... • http://advisories.mageia.org/MGASA-2015-0068.html • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2015-0236 – libvirt: missing ACL check for the VIR_DOMAIN_XML_SECURE flag in save images and snapshots objects
https://notcve.org/view.php?id=CVE-2015-0236
29 Jan 2015 — libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. libvirt anterior a 1.2.12 permite a usuarios remotos autenticados obtener la contraseña VNC mediante el uso del indicador VIR_DOMAIN_XML_SECURE con (1) una instantánea manipulada a la interfaz virDomainSnapshotGetXMLDesc o (2) una imagen manipulada a la int... • http://advisories.mageia.org/MGASA-2015-0046.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2014-8136 – libvirt: local denial of service in qemu/qemu_driver.c
https://notcve.org/view.php?id=CVE-2014-8136
19 Dec 2014 — The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors. Las funciones (1) qemuDomainMigratePerform y (2) qemuDomainMigrateFinish2 en qemu/qemu_driver.c en libvirt no desbloquea el dominio cuando una comprobación de ACL falla, lo que permite a usuarios locales provocar una denegación de servicio a través de vectores sin especifica... • http://advisories.mageia.org/MGASA-2015-0002.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-9253 – Mandriva Linux Security Advisory 2015-185
https://notcve.org/view.php?id=CVE-2014-9253
17 Dec 2014 — The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php. La configuración de la lista blanca del tipo de ficheros por defecto en conf/mime.conf en Media Manager en DokuWiki anterior a 2014-09-29b permite a atacantes remotos ejecutar secuencias de comandos web o HTML arbitrarios mediante la subida d... • http://advisories.mageia.org/MGASA-2014-0540.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 7EXPL: 0CVE-2014-8116 – file: multiple denial of service issues (resource consumption)
https://notcve.org/view.php?id=CVE-2014-8116
10 Dec 2014 — The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities. El intérprete ELF (readelf.c) en versiones anteriores a 5.21, permite a atacantes remotos, provocar una denegaci?o de servicio (consumo de CPU o rotura) mediante un número largo de (1) programa o (2) cabeceras de sección o (3) capacidades no válidas. Multiple flaws were found in the way the File In... • http://advisories.mageia.org/MGASA-2015-0040.html • CWE-399: Resource Management Errors CWE-674: Uncontrolled Recursion •
CVSS: 7.5EPSS: 9%CPEs: 7EXPL: 0CVE-2014-8117 – file: denial of service issue (resource consumption)
https://notcve.org/view.php?id=CVE-2014-8117
10 Dec 2014 — softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors. softmagic.c en archivo anterior a 5.21 no limita adecuadamente el límite de recursividad, esto permite a atacantes remotos, provocar una denegación de servicio (consumo de CPU o rotura) mediante vectores no especificados. A flaw was found in the way the File Information (fileinfo) extension parsed Executable and Linkable Format (ELF... • http://advisories.mageia.org/MGASA-2015-0040.html • CWE-399: Resource Management Errors CWE-674: Uncontrolled Recursion •