CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-6402 – chromium-browser: Insufficient policy enforcement in downloads
https://notcve.org/view.php?id=CVE-2020-6402
Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. Una aplicación insuficiente de la política en downloads en Google Chrome sobre OS X versiones anteriores a 80.0.3987.87, permitió a un atacante que convenció a un usuario a instalar una extensión maliciosa para ejecutar código arbitrario por medio de una extensión de Chrome diseñada. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html https://access.redhat.com/errata/RHSA-2020:0514 https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html https://crbug.com/1029375 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 1CVE-2019-15623
https://notcve.org/view.php?id=CVE-2019-15623
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. Una exposición de información privada en Nextcloud Server versión 16.0.1, causa que el servidor envíe su dominio e ID de usuario hacia el Nextcloud Lookup Server sin más datos cuando el servidor Lookup está deshabilitado. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html https://hackerone.com/reports/508490 https://nextcloud.com/security/advisory/?id=NC-SA-2019-016 • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 1CVE-2020-8118
https://notcve.org/view.php?id=CVE-2020-8118
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application. Un ataque de tipo server-side request forgery autenticado en Nextcloud versión 16.0.1, permitió detectar servicios locales y remotos al agregar una nueva suscripción en la aplicación calendar. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html https://hackerone.com/reports/427835 https://nextcloud.com/security/advisory/?id=NC-SA-2019-014 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-3693 – Local privilege escalation from user wwwrun to root in the packaging of mailman
https://notcve.org/view.php?id=CVE-2019-3693
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions. Una vulnerabilidad de tipo symlink following en el empaquetado de mailman en SUSE Linux Enterprise Server versión 11, SUSE Linux Enterprise Server versión 12; openSUSE Leap versión 15.1, permitió a atacantes locales escalar sus privilegios desde un usuario wwwrun a root. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html https://bugzilla.suse.com/show_bug.cgi?id=1154328 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2019-3692 – Local privilege escalation from user news to root in the packaging of inn
https://notcve.org/view.php?id=CVE-2019-3692
The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version 2.6.2-2.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.2.47 and prior versions. El empaquetado de inn en SUSE Linux Enterprise Server versión 11; openSUSE Factory, Leap versión 15.1, permite a atacantes locales escalar desde un usuario inn a root, mediante ataques de tipo symlink. Este problema afecta a: inn versión 2.4.2-170.21.3.1 y versiones anteriores, de SUSE Linux Enterprise Server versión 11. inn versión 2.6.2-2.2 y versiones anteriores, de openSUSE Factory . inn versión 2.5.4-lp151.2.47 y versiones anteriores de openSUSE Leap versión 15.1. • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00028.html https://bugzilla.suse.com/show_bug.cgi?id=1154302 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •