CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2020-16006 – chromium-browser: Inappropriate implementation in V8
https://notcve.org/view.php?id=CVE-2020-16006
03 Nov 2020 — Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una implementación inapropiada en V8 en Google Chrome anterior a versión 86.0.4240.183, permitía a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 86.0.4240.183. Issues addressed include b... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 30EXPL: 0CVE-2020-14803 – OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136)
https://notcve.org/view.php?id=CVE-2020-14803
21 Oct 2020 — Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applicati... • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-25829 – Gentoo Linux Security Advisory 202012-19
https://notcve.org/view.php?id=CVE-2020-25829
16 Oct 2020 — An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process). Se ha encontrado un problema en PowerDNS... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15229 – Path traversal and files overwrite with unsquashfs
https://notcve.org/view.php?id=CVE-2020-15229
14 Oct 2020 — Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host filesystem during the extraction with a crafted squashfs filesystem. The extraction occurs automatically for unprivileged (either installation or with `allow setuid = no`) run of Singularity when a user attempt to run an image which is a local SIF image o... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00070.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 3%CPEs: 11EXPL: 0CVE-2020-26934 – Gentoo Linux Security Advisory 202101-35
https://notcve.org/view.php?id=CVE-2020-26934
10 Oct 2020 — phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. phpMyAdmin versiones anteriores a 4.9.6 y versiones 5.x anteriores a 5.0.3, permite un ataque de tipo XSS por medio de la funcionalidad de transformación mediante un enlace diseñado It was discovered that there was a bug in the way phpMyAdmin handles the phpMyAdmin Configuration Storage tables. An authenticated attacker could use this vulnerability to cause phpmyAdmin to leak sensitive files. It wa... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 80%CPEs: 11EXPL: 1CVE-2020-26935 – Gentoo Linux Security Advisory 202101-35
https://notcve.org/view.php?id=CVE-2020-26935
10 Oct 2020 — An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query. Se detectó un problema en SearchController en phpMyAdmin versiones anteriores a 4.9.6 y versiones 5.x anteriores a 5.0.3. Se detectó una vulnerabilidad de inyección SQL en cómo phpMyAdmin procesa las sentencias SQL en la funcionalidad de... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-26164 – Gentoo Linux Security Advisory 202101-16
https://notcve.org/view.php?id=CVE-2020-26164
07 Oct 2020 — In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack. En kdeconnect-kde (también se conoce como KDE Connect) versiones anteriores a 20.08.2, un atacante en la red local podría enviar paquetes diseñados que desencadenan el uso de grandes cantidades de CPU, memoria o slots de conexión de red, también se conoce como un ataque de Denegación de S... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00016.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 54%CPEs: 7EXPL: 0CVE-2020-11800
https://notcve.org/view.php?id=CVE-2020-11800
07 Oct 2020 — Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code. Zabbix Server versiones 2.2.x y 3.0.x anteriores a 3.0.31 y 3.2, permite a atacantes remotos ejecutar código arbitrario • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00007.html •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 1CVE-2020-8228
https://notcve.org/view.php?id=CVE-2020-8228
05 Oct 2020 — A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. Una falta de límite de velocidad en la aplicación Preferred Providers versión 1.7.0, permitió a un atacante ajustar la contraseña una cantidad de veces no controlada • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-840: Business Logic Errors •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11556
https://notcve.org/view.php?id=CVE-2019-11556
25 Sep 2020 — Pagure before 5.6 allows XSS via the templates/blame.html blame view. Pagure versiones anteriores a 5.6, permite ataques de tipo XSS por medio de la vista dblame en el archivo templates/blame.html • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00066.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •