CVSS: 5.3EPSS: 0%CPEs: 17EXPL: 0CVE-2020-14550 – mysql: C API unspecified vulnerability (CPU Jul 2020)
https://notcve.org/view.php?id=CVE-2020-14550
Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.1 Base Score 5.3 (Availability impacts). • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAI7GRYZ5265JVKHC6VXI57MNJDDB63C https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYQPCHGCVKFS3H226QQKZFQP56JYOQ3T https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SA2XMR2ZY2BPR3VLTDVLNV74JL7TA7KL https://security.gentoo.org/glsa/202105-27 https://security.netapp.com/advisory/ntap-20210622-0001 https://usn.ubuntu.com/4441-1 https://www.oracle.com/security •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2020-14553 – mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2020)
https://notcve.org/view.php?id=CVE-2020-14553
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAI7GRYZ5265JVKHC6VXI57MNJDDB63C https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYQPCHGCVKFS3H226QQKZFQP56JYOQ3T https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SA2XMR2ZY2BPR3VLTDVLNV74JL7TA7KL https://security.gentoo.org/glsa/202105-27 https://security.netapp.com/advisory/ntap-20200717-0004 https://usn.ubuntu.com/4441-1 https://www.oracle.com/security •
CVSS: 9.3EPSS: 2%CPEs: 21EXPL: 1CVE-2020-8174 – nodejs: memory corruption in napi_get_value_string_* functions
https://notcve.org/view.php?id=CVE-2020-8174
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. La función napi_get_value_string_*(), permite varios tipos de corrupción de memoria en node versiones anteriores a 10.21.0, 12.18.0 y versiones anteriores a 14.4.0 A flaw was found in nodejs. Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16() with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer. • https://hackerone.com/reports/784186 https://security.gentoo.org/glsa/202101-07 https://security.netapp.com/advisory/ntap-20201023-0003 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/security-alerts/cpuoct2020.html https://access.redhat.com/security/cve/CVE-2020-8174 https://bugzilla.redhat.com/show_bug.cgi?id=1845256 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 1CVE-2020-4051 – XSS in Dijit Editor's LinkDialog plugin
https://notcve.org/view.php?id=CVE-2020-4051
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3. En Dijit versiones anteriores a 1.11.11, y superiores o igual a 1.12.0 y menores a 1.12.9, y superiores o igual a 1.13.0 y menores a 1.13.8, y superiores o igual a 1.14.0 y menores a 1.14.7, y superiores o igual a 1.15.0 y menores a 1.15.4, y superiores o igual a 1.16.0 y menores a 1.16.3, se presenta una vulnerabilidad de tipo cross-site scripting en el plugin LinkDialog de Editor. Esto se ha corregido en las versiones 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3 • https://github.com/ossf-cve-benchmark/CVE-2020-4051 https://github.com/dojo/dijit/commit/462bdcd60d0333315fe69ab4709c894d78f61301 https://github.com/dojo/dijit/security/advisories/GHSA-cxjc-r2fp-7mq6 https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html https://security.netapp.com/advisory/ntap-20201023-0003 https://www.oracle.com/security-alerts/cpuoct2020.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2020-10705 – undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header
https://notcve.org/view.php?id=CVE-2020-10705
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service. Se detectó una fallo en Undertow versiones anteriores a Undertow 2.1.1.Final, donde ciertas peticiones al encabezado "Expect: 100-continue" pueden causar un error de falta de memoria. Este defecto puede conllevar potencialmente a una denegación de servicio A flaw was discovered in Undertow where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service. • https://bugzilla.redhat.com/show_bug.cgi?id=1803241 https://security.netapp.com/advisory/ntap-20220210-0014 https://access.redhat.com/security/cve/CVE-2020-10705 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •