CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2020-8621 – Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c
https://notcve.org/view.php?id=CVE-2020-8621
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected. En BIND versiones 9.14.0 -) 9.16.5, 9.17.0 -) 9.17.3, si un servidor está configurado con minimización de QNAME y "forward first", entonces un atacante que pueda enviarle consultas puede ser capaz de desencadenar la condición que causará que el servidor se bloquee. Los servidores con "forward only" no están afectados. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html https://kb.isc.org/docs/cve-2020-8621 https://security.gentoo.org/glsa/202008-19 https://security.netapp.com/advisory/ntap-20200827-0003 https://usn.ubuntu.com/4468-1 https://www.synology.com/security/advisory/Synology_SA_20_19 • CWE-617: Reachable Assertion •
CVSS: 10.0EPSS: 43%CPEs: 25EXPL: 32CVE-2020-1472 – Microsoft Netlogon Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-1472
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications. • https://www.exploit-db.com/exploits/49071 https://github.com/SecuraBV/CVE-2020-1472 https://github.com/dirkjanm/CVE-2020-1472 https://github.com/VoidSec/CVE-2020-1472 https://github.com/k8gege/CVE-2020-1472-EXP https://github.com/cube0x0/CVE-2020-1472 https://github.com/sv3nbeast/CVE-2020-1472 https://github.com/thatonesecguy/zerologon-CVE-2020-1472 https://github.com/CanciuCostin/CVE-2020-1472 https://github.com/0xkami/CVE-2020-1472 https://github.com/striveben&#x • CWE-287: Improper Authentication CWE-330: Use of Insufficiently Random Values •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2019-11823
https://notcve.org/view.php?id=CVE-2019-11823
CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic. Una vulnerabilidad de inyección de CRLF en Network Center en Synology Router Manager (SRM) versiones anteriores a la versión 1.2.3-8017-2, permite a atacantes remotos causar una denegación de servicio (lectura fuera de límites y bloqueo de aplicación) por medio de un tráfico de red diseñado. • https://www.synology.com/security/advisory/Synology_SA_20_11 https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1051 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-9502 – Broadcom wl driver is vulnerable to heap buffer overflow
https://notcve.org/view.php?id=CVE-2019-9502
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer overflow is triggered in wlc_wpa_plumb_gtk. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions. El controlador Broadcom wl WiFi es vulnerable a un desbordamiento del búfer de la pila. • https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html https://kb.cert.org/vuls/id/166939 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2019-9501 – Broadcom wl driver is vulnerable to heap buffer overflow
https://notcve.org/view.php?id=CVE-2019-9501
The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap buffer overflow is triggered in wlc_wpa_sup_eapol. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions. El controlador Broadcom wl WiFi es vulnerable a un desbordamiento del búfer de la pila. • https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html https://kb.cert.org/vuls/id/166939 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •