CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2020-14718
https://notcve.org/view.php?id=CVE-2020-14718
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: JVMCI). Supported versions that are affected are 19.3.2 and 20.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). • https://www.oracle.com/security-alerts/cpujul2020.html •
CVSS: 7.4EPSS: 0%CPEs: 12EXPL: 1CVE-2020-8172 – nodejs: TLS session reuse can lead to hostname verification bypass
https://notcve.org/view.php?id=CVE-2020-8172
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. La reutilización de una sesión TLS puede conllevar a una omisión de la verificación del certificado del host en node versión anterior a 12.18.0 y anterior a 14.4.0 A TLS Hostname verification bypass vulnerability exists in NodeJS. This flaw allows an attacker to bypass TLS Hostname verification when a TLS client reuses HTTPS sessions. • https://hackerone.com/reports/811502 https://nodejs.org/en/blog/vulnerability/june-2020-security-releases https://security.gentoo.org/glsa/202101-07 https://security.netapp.com/advisory/ntap-20200625-0002 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://ac • CWE-285: Improper Authorization CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 1%CPEs: 23EXPL: 0CVE-2020-11080 – Denial of service in nghttp2
https://notcve.org/view.php?id=CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090 https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394 https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject& • CWE-400: Uncontrolled Resource Consumption CWE-707: Improper Neutralization CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-17561
https://notcve.org/view.php?id=CVE-2019-17561
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. El sistema de actualización automática de "Apache NetBeans" no comprueba completamente las firmas de código. Un atacante podría modificar el nbm descargado e incluir un código adicional. • https://lists.apache.org/thread.html/rb218aa720fc525f63d91761fbf67854f454ce7a697dbbee2001ae8b1%40%3Cdev.netbeans.apache.org%3E https://www.oracle.com/security-alerts/cpujul2020.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-17560
https://notcve.org/view.php?id=CVE-2019-17560
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. El sistema de actualización automática de "Apache NetBeans" no comprueba los certificados SSL y los nombres de host para descargas basadas en https. Esto permite a un atacante interceptar descargas de actualizaciones automáticas y modificar la descarga, inyectando potencialmente código malicioso. • https://lists.apache.org/thread.html/r354d7654efa1050539fe56a3257696d1faeea4f3f9b633c29ec89609%40%3Cdev.netbeans.apache.org%3E https://www.oracle.com/security-alerts/cpujul2020.html • CWE-295: Improper Certificate Validation •