CVSS: 5.9EPSS: 0%CPEs: 9EXPL: 0CVE-2020-14422 – python: DoS via inefficiency in IPv{4,6}Interface classes
https://notcve.org/view.php?id=CVE-2020-14422
18 Jun 2020 — Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html • CWE-330: Use of Insufficiently Random Values CWE-400: Uncontrolled Resource Consumption CWE-682: Incorrect Calculation •
CVSS: 4.9EPSS: 5%CPEs: 11EXPL: 0CVE-2020-8619 – A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer
https://notcve.org/view.php?id=CVE-2020-8619
17 Jun 2020 — In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause deni... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-404: Improper Resource Shutdown or Release CWE-617: Reachable Assertion •
CVSS: 4.9EPSS: 2%CPEs: 5EXPL: 0CVE-2020-8618 – A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer
https://notcve.org/view.php?id=CVE-2020-8618
17 Jun 2020 — An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients. Un atacante al que se le permite enviar datos de zona a un servidor mediante la transferencia de zona puede explotar esto para provocar intencionalmente el fallo de aserción con una zona especialmente construida, negando el servicio a los clientes It was discovered that Bind incorrectly handled large respon... • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 2%CPEs: 8EXPL: 0CVE-2020-14399
https://notcve.org/view.php?id=CVE-2020-14399
17 Jun 2020 — An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed. **EN DISPUTA** Se detectó un problema en LibVNCServer versiones anteriores a 0.9.13. Los datos Byte-aligned son accedidos por medio de punteros uint32_t en la biblioteca libvncclient/rfbproto.c. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html •
CVSS: 7.5EPSS: 2%CPEs: 8EXPL: 0CVE-2020-14400 – Ubuntu Security Notice USN-4434-1
https://notcve.org/view.php?id=CVE-2020-14400
17 Jun 2020 — An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary ** EN DISPUTA ** Se detectó un problema en LibVNCServer versiones anteriores a 0.9.13. Los datos Byte-aligned son accedidos por medio de punteros uint16_t en la biblioteca libvncserver/translate.c. NOTA: Los terceros no consideran que se ... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html •
CVSS: 6.5EPSS: 1%CPEs: 17EXPL: 0CVE-2020-14401 – Ubuntu Security Notice USN-4434-1
https://notcve.org/view.php?id=CVE-2020-14401
17 Jun 2020 — An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow. Se detectó un problema en LibVNCServer versiones anteriores a 0.9.13. La biblioteca libvncserver/scale.c presenta un desbordamiento de enteros en la función pixel_value Ramin Farajpour Cami discovered that LibVNCServer incorrectly handled certain malformed unix socket names. A remote attacker could exploit this with a crafted socket name, leading to a denial of service, or possibly execute arbitra... • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.9EPSS: 1%CPEs: 11EXPL: 0CVE-2020-14093 – Debian Security Advisory 4707-1
https://notcve.org/view.php?id=CVE-2020-14093
15 Jun 2020 — Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. Mutt versiones anteriores a 1.14.3, permite un ataque de tipo man-in-the-middle de fcc/postpone de IMAP por medio de una respuesta PREAUTH It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to enable MITM attacks. It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this issue to proceeds with a connection even if... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2020-14004
https://notcve.org/view.php?id=CVE-2020-14004
12 Jun 2020 — An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user. Se detectó un problema en Icinga2 versiones anteriores a v2.12.0-rc1. • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 4.4EPSS: 0%CPEs: 41EXPL: 0CVE-2020-10732 – kernel: uninitialized kernel data leak in userspace coredumps
https://notcve.org/view.php?id=CVE-2020-10732
12 Jun 2020 — A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data. Se encontró un fallo en la implementación de los volcados de núcleo del Userspace del kernel de Linux. Este fallo permite a un atacante con una cuenta local bloquear un programa trivial y exfiltrar datos privados del kernel A flaw was found in the Linux kernel’s implementation of Userspace core dumps. This flaw allows ... • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html • CWE-908: Use of Uninitialized Resource •
CVSS: 7.8EPSS: 0%CPEs: 29EXPL: 0CVE-2020-1269
https://notcve.org/view.php?id=CVE-2020-1269
09 Jun 2020 — An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316. Se presenta una vulnerabilidad de elevación de privilegios cuando el kernel de Windows presenta un fallo al manejar apropiadamente ... • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00035.html •