CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 1CVE-2020-6404 – chromium-browser: Inappropriate implementation in Blink
https://notcve.org/view.php?id=CVE-2020-6404
11 Feb 2020 — Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. La implementación inapropiada en Blink en Google Chrome versiones anteriores a 80.0.3987.87 permitió a un atacante remoto explotar potencialmente una corrupción de la pila mediante una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed include... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2020-6406 – chromium-browser: Use after free in audio
https://notcve.org/view.php?id=CVE-2020-6406
11 Feb 2020 — Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso la memoria previamente liberada en audio en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed include... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-6408 – chromium-browser: Insufficient policy enforcement in CORS
https://notcve.org/view.php?id=CVE-2020-6408
11 Feb 2020 — Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page. Una aplicación insuficiente de la política en CORS en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante local obtener información potencialmente confidencial por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issu... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-6397 – chromium-browser: Incorrect security UI in sharing
https://notcve.org/view.php?id=CVE-2020-6397
11 Feb 2020 — Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. Una implementación inapropiada en sharing en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto falsificar la Interfaz de Usuario de seguridad por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed include informatio... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2020-6398 – chromium-browser: Uninitialized use in PDFium
https://notcve.org/view.php?id=CVE-2020-6398
11 Feb 2020 — Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Un uso de datos no inicializados en PDFium en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de un archivo PDF diseñado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed in... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html • CWE-908: Use of Uninitialized Resource •
CVSS: 6.5EPSS: 1%CPEs: 11EXPL: 1CVE-2020-6400 – chromium-browser: Inappropriate implementation in CORS
https://notcve.org/view.php?id=CVE-2020-6400
11 Feb 2020 — Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Una implementación inapropiada en CORS en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto filtrar datos de origen cruzado por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed include information leakage, null ... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html • CWE-203: Observable Discrepancy •
CVSS: 6.1EPSS: 4%CPEs: 12EXPL: 1CVE-2020-7106 – Gentoo Linux Security Advisory 202003-40
https://notcve.org/view.php?id=CVE-2020-7106
16 Jan 2020 — Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS). Cacti versión 1.2.8, tiene un vulnerabilidad de tipo XSS almacenado en los archivos data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php,... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 12%CPEs: 13EXPL: 0CVE-2019-19925 – sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive
https://notcve.org/view.php?id=CVE-2019-19925
24 Dec 2019 — zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive. La función zipfileUpdate en el archivo ext/misc/zipfile.c en SQLite versión 3.30.1, maneja inapropiadamente un nombre de ruta NULL durante una actualización de un archivo ZIP. It was discovered that SQLite incorrectly handled certain shadow tables. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. It was discovered t... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 13%CPEs: 13EXPL: 0CVE-2019-19923 – sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference
https://notcve.org/view.php?id=CVE-2019-19923
24 Dec 2019 — flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results). La función flattenSubquery en el archivo select.c en SQLite versión 3.30.1 maneja inapropiadamente ciertos usos de SELECT DISTINCT que involucra una LEFT JOIN en la que el lado derecho es una vista. Esto puede causar una desreferencia del puntero NULL (o resultados incorrectos). It was discovere... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 11%CPEs: 13EXPL: 0CVE-2019-19926 – sqlite: error mishandling because of incomplete fix of CVE-2019-19880
https://notcve.org/view.php?id=CVE-2019-19926
23 Dec 2019 — multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880. La función multiSelect en el archivo select.c en SQLite versión 3.30.1, maneja inapropiadamente determinados errores durante el análisis, como es demostrado por los errores de las llamadas de sqlite3WindowRewrite(). NOTA: esta vulnerabilidad se presenta debido a una corrección incomplet... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html • CWE-476: NULL Pointer Dereference •