CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18932
https://notcve.org/view.php?id=CVE-2019-18932
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.html http://www.openwall.com/lists/oss-security/2020/01/20/6 http://www.openwall.com/lists/oss-security/2020/01/27/1 https://bugzilla.suse.com/show_bug.cgi?id=1150554 https://seclists.org/oss-sec/2020/q1/23 https://security.gentoo.org/glsa/202007-32 https://sourceforge.net/projects/sarg • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 10.0EPSS: 45%CPEs: 1EXPL: 0CVE-2008-1167
https://notcve.org/view.php?id=CVE-2008-1167
Stack-based buffer overflow in the useragent function in useragent.c in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to execute arbitrary code via a long Squid proxy server User-Agent header. NOTE: some of these details are obtained from third party information. Desbordamiento de búfer basado en pila en una función useragent de useragent.c en Squid Analysis Report Generator (Sarg) permite a atacantes remotos ejecutar código de su elección a través una cabecera User-Agent en un servidor proxy de Squid. NOTA: algunos de estos detalles han sido obtenidos a partir de la información de terceros. • http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://secunia.com/advisories/28668 http://secunia.com/advisories/29309 http://secunia.com/advisories/29323 http://secunia.com/advisories/29500 http://sourceforge.net/project/shownotes.php?release_id=581212 http://www.gentoo.org/security/en/glsa/glsa-200803-21.xml http://www.mandriva.com/security/advisories?name=MDVSA-2008:079 http://www.securityfocus.com/archive/1/489018/100/0/threaded http://www.securit • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1168
https://notcve.org/view.php?id=CVE-2008-1168
Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Squid Analysis Report Generator (Sarg) 2.2.3.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de la cabecera User-Agent, la cual no se manipula correctamente cuando se muestra el log del proxy de Squid. NOTA: el origen de esta información es desconocido; los detalles se han obtenido únicamente de información de terceros. • http://secunia.com/advisories/28668 http://secunia.com/advisories/29309 http://secunia.com/advisories/29500 http://sourceforge.net/project/shownotes.php?release_id=581509 http://www.gentoo.org/security/en/glsa/glsa-200803-21.xml http://www.mandriva.com/security/advisories?name=MDVSA-2008:079 http://www.securityfocus.com/bid/28077 http://www.vupen.com/english/advisories/2008/0750/references https://exchange.xforce.ibmcloud.com/vulnerabilities/40972 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •