CVSS: 9.8EPSS: 87%CPEs: 260EXPL: 2CVE-2019-5544 – VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2019-5544
06 Dec 2019 — OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. OpenSLP, como es usado en ESXi y los dispositivos Horizon DaaS, presenta un problema de sobrescritura de la pila. VMware ha evaluado la gravedad de este problema para estar en el rango de gravedad Crítica con una puntuación base máxima CVSSv3 de 9.8. A heap overflow vulnerability was found in OpenSLP.... • https://github.com/HynekPetrak/CVE-2019-5544_CVE-2020-3992 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 324EXPL: 0CVE-2019-11135 – hw: TSX Transaction Asynchronous Abort (TAA)
https://notcve.org/view.php?id=CVE-2019-11135
12 Nov 2019 — TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. Una condición de tipo TSX Asynchronous Abort en algunas CPU que utilizan ejecución especulativa puede habilitar a un usuario autenticado para permitir potencialmente una divulgación de información por medio de un canal lateral con acceso local. A flaw was found in the way Intel CPUs handle speculative execution of ins... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00045.html • CWE-203: Observable Discrepancy •
CVSS: 9.3EPSS: 0%CPEs: 10EXPL: 0CVE-2019-8814 – webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
https://notcve.org/view.php?id=CVE-2019-8814
01 Nov 2019 — Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Múltiples problemas de corrupción de memoria fueron abordados mejorando el manejo de la memoria. Este problema es corregido en iOS versión 13.2 y iPadOS versión 13.2, tvOS versión 13.2, Safari versi... • https://security.gentoo.org/glsa/202003-22 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 1%CPEs: 10EXPL: 0CVE-2019-8815 – webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
https://notcve.org/view.php?id=CVE-2019-8815
01 Nov 2019 — Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Múltiples problemas de corrupción de memoria fueron abordados mejorando el manejo de la memoria. Este problema es corregido en iOS versión 13.2 y iPadOS versión 13.2, tvOS versión 13.2, Safari versi... • https://security.gentoo.org/glsa/202003-22 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 11EXPL: 0CVE-2019-8816 – webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
https://notcve.org/view.php?id=CVE-2019-8816
01 Nov 2019 — Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution. Múltiples problemas de corrupción de memoria fueron abordados mejorando el manejo de la memoria. Este problema es corregido en iOS versión 13.2 y iPadOS versión 13.2, tvOS versión 13.2,... • https://security.gentoo.org/glsa/202003-22 • CWE-787: Out-of-bounds Write •
CVSS: 9.1EPSS: 0%CPEs: 10EXPL: 0CVE-2019-17631 – JDK: Unrestricted access to diagnostic operations
https://notcve.org/view.php?id=CVE-2019-17631
17 Oct 2019 — From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. Eclipse OpenJ9 desde las versiones 0.15 hasta 0.16, se accede a operaciones de diagnóstico tales como causar un GC o crear un archivo de diagnóstico sin ninguna comprobación de privilegios. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR6. I... • https://access.redhat.com/errata/RHSA-2019:4113 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •
CVSS: 4.2EPSS: 2%CPEs: 19EXPL: 0CVE-2019-2996 – JDK: unspecified vulnerability fixed in 8u221 (Deployment)
https://notcve.org/view.php?id=CVE-2019-2996
16 Oct 2019 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete acc... • http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html •
CVSS: 4.3EPSS: 0%CPEs: 37EXPL: 0CVE-2019-2962 – OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690)
https://notcve.org/view.php?id=CVE-2019-2962
16 Oct 2019 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html • CWE-476: NULL Pointer Dereference •
CVSS: 4.3EPSS: 0%CPEs: 36EXPL: 0CVE-2019-2964 – OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684)
https://notcve.org/view.php?id=CVE-2019-2964
16 Oct 2019 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. N... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html • CWE-248: Uncaught Exception •
CVSS: 4.3EPSS: 0%CPEs: 39EXPL: 0CVE-2019-2973 – OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)
https://notcve.org/view.php?id=CVE-2019-2973
16 Oct 2019 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Th... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00064.html • CWE-248: Uncaught Exception •