CVSS: 8.6EPSS: 8%CPEs: 12EXPL: 0CVE-2020-24606 – squid: Improper input validation could result in a DoS
https://notcve.org/view.php?id=CVE-2020-24606
24 Aug 2020 — Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. Squid versiones anteriores a 4.13 y versiones 5.x anteriores a 5.0.4, permite que un peer de confianza lleve a cabo una Denegación de Servicio mediante el... • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html • CWE-20: Improper Input Validation CWE-667: Improper Locking •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2020-8622 – A truncated TSIG response can lead to an assertion failure
https://notcve.org/view.php?id=CVE-2020-8622
21 Aug 2020 — In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the pack... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 2%CPEs: 16EXPL: 0CVE-2020-8623 – A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c
https://notcve.org/view.php?id=CVE-2020-8623
21 Aug 2020 — In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker En BIND versiones 9.10.0 -) 9.11.21, 9.12.0 -) 9.16.5, 9.17.0 -) 9... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-400: Uncontrolled Resource Consumption CWE-617: Reachable Assertion •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2020-8624 – update-policy rules of type "subdomain" are enforced incorrectly
https://notcve.org/view.php?id=CVE-2020-8624
21 Aug 2020 — In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone. En BIND versiones 9.9.12 -) 9.9.13, 9.10.7 -) 9.10.8, 9.11.3 -) 9.11.21, 9.12.1 -) 9.16.5, 9.17.0 -) 9.17.3, también afecta a ve... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-269: Improper Privilege Management CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 94%CPEs: 25EXPL: 69CVE-2020-1472 – Microsoft Netlogon Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-1472
17 Aug 2020 — An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the... • https://packetstorm.news/files/id/180777 • CWE-287: Improper Authentication CWE-330: Use of Insufficiently Random Values •
CVSS: 5.3EPSS: 3%CPEs: 4EXPL: 2CVE-2020-24370 – lua: segmentation fault in getlocal and setlocal functions in ldebug.c
https://notcve.org/view.php?id=CVE-2020-24370
17 Aug 2020 — ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). El archivo ldebug.c en Lua versión 5.4.0, permite un desbordamiento de negación y un error de segmentación en getlocal y setlocal, como es demostrado por getlocal (3,2^31). Red Hat Advanced Cluster Management for Kubernetes 2.2.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reli... • https://github.com/RenukaSelvar/lua_CVE-2020-24370 • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-682: Incorrect Calculation •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 1CVE-2020-17498 – Ubuntu Security Notice USN-6262-1
https://notcve.org/view.php?id=CVE-2020-17498
13 Aug 2020 — In Wireshark 3.2.0 to 3.2.5, the Kafka protocol dissector could crash. This was addressed in epan/dissectors/packet-kafka.c by avoiding a double free during LZ4 decompression. En Wireshark versiones 3.2.0 hasta 3.2.5, el disector del protocolo Kafka podría bloquearse. Esto fue abordado en el archivo epan/dissectors/packet-kafka.c evitando una doble liberación durante la descompresión de LZ4 It was discovered that Wireshark did not properly handle certain NFS packages when certain configuration options were ... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00035.html • CWE-415: Double Free •
CVSS: 5.3EPSS: 5%CPEs: 5EXPL: 0CVE-2020-17507 – qt: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp
https://notcve.org/view.php?id=CVE-2020-17507
12 Aug 2020 — An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. Se detectó un problema en Qt versiones hasta 5.12.9 y versiones 5.13.x hasta 5.15.x anteriores a 5.15.1. La función read_xbm_body en el archivo gui/image/qxbmhandler.cpp presenta una lectura excesiva del búfer It was discovered that Qt incorrectly handled certain XBM image files. If a user or automated system were tricked into opening a specially crafted P... • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html • CWE-125: Out-of-bounds Read •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-16145 – Debian Security Advisory 4744-1
https://notcve.org/view.php?id=CVE-2020-16145
12 Aug 2020 — Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15. Roundcube Webmail versiones anteriores a 1.3.15 y 1.4.8, permite un ataque de tipo XSS almacenado en mensajes HTML durante la visualización de mensajes por medio de un documento SVG diseñado. Este problema se ha solucionado en la versión 1.4.8 y versión 1.3.15. It was discovered that roundcube, a skinnable AJAX based webmail solution f... • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 10EXPL: 1CVE-2020-12673 – dovecot: Out of bound reads in dovecot NTLM implementation
https://notcve.org/view.php?id=CVE-2020-12673
12 Aug 2020 — In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. En Dovecot versiones anteriores a 2.3.11.3, el envío de una petición NTLM con formato especial bloqueará el servicio auth debido a una lectura fuera de límites A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat fro... • http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00048.html • CWE-125: Out-of-bounds Read •