CVSS: 6.5EPSS: 4%CPEs: 6EXPL: 0CVE-2019-18420 – Gentoo Linux Security Advisory 202003-56
https://notcve.org/view.php?id=CVE-2019-18420
31 Oct 2019 — An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time ... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html • CWE-134: Use of Externally-Controlled Format String •
CVSS: 5.4EPSS: 1%CPEs: 7EXPL: 0CVE-2019-14833 – Ubuntu Security Notice USN-4167-1
https://notcve.org/view.php?id=CVE-2019-14833
29 Oct 2019 — A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dict... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html • CWE-305: Authentication Bypass by Primary Weakness CWE-521: Weak Password Requirements •
CVSS: 4.9EPSS: 2%CPEs: 5EXPL: 1CVE-2019-14847 – Ubuntu Security Notice USN-4167-2
https://notcve.org/view.php?id=CVE-2019-14847
29 Oct 2019 — A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with this issue. Se encontró un fallo en samba versión 4.0.0 anteriores a samba 4.9.15 y samba versiones 4.10.x anteriores a 4.10.10. Un atacante puede bloquear el servidor AD DC LDAP por medio de la sincronización de directorios resultando en la denegación de servicio. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 6%CPEs: 5EXPL: 0CVE-2019-10218 – samba: smb client vulnerable to filenames containing path separators
https://notcve.org/view.php?id=CVE-2019-10218
29 Oct 2019 — A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. Se encontró un fallo en el cliente de samba, todas las versiones de samba anteriores a samba 4.11.2, 4.... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 1CVE-2019-18218 – file: heap-based buffer overflow in cdf_read_property_info in cdf.c
https://notcve.org/view.php?id=CVE-2019-18218
21 Oct 2019 — cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). La función cdf_read_property_info en el archivo cdf.c en file versiones hasta 5.37, no restringe el número de elementos CDF_VECTOR, lo que permite un desbordamiento del búfer en la región heap de la memoria (escritura fuera de límites de 4 bytes). Red Hat Advanced Cluster Management for Kubernetes 2.2.10 images Red Hat Advanced Clus... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00044.html • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 4.4EPSS: 0%CPEs: 13EXPL: 0CVE-2019-3009 – mysql: Server: Connection unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-3009
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 6.5EPSS: 0%CPEs: 13EXPL: 0CVE-2019-3011 – mysql: Server: C API unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-3011
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 4.4EPSS: 0%CPEs: 13EXPL: 0CVE-2019-3018 – mysql: InnoDB unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-3018
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 5.5EPSS: 0%CPEs: 13EXPL: 0CVE-2019-2991 – mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-2991
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.017 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL S... • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 5.3EPSS: 0%CPEs: 14EXPL: 0CVE-2019-2993 – mysql: Server: C API unspecified vulnerability (CPU Oct 2019)
https://notcve.org/view.php?id=CVE-2019-2993
16 Oct 2019 — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •