CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-6408 – chromium-browser: Insufficient policy enforcement in CORS
https://notcve.org/view.php?id=CVE-2020-6408
11 Feb 2020 — Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page. Una aplicación insuficiente de la política en CORS en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante local obtener información potencialmente confidencial por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issu... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-6397 – chromium-browser: Incorrect security UI in sharing
https://notcve.org/view.php?id=CVE-2020-6397
11 Feb 2020 — Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page. Una implementación inapropiada en sharing en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto falsificar la Interfaz de Usuario de seguridad por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed include informatio... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 0CVE-2020-6398 – chromium-browser: Uninitialized use in PDFium
https://notcve.org/view.php?id=CVE-2020-6398
11 Feb 2020 — Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Un uso de datos no inicializados en PDFium en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto explotar potencialmente una corrupción de la pila por medio de un archivo PDF diseñado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed in... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html • CWE-908: Use of Uninitialized Resource •
CVSS: 6.5EPSS: 1%CPEs: 11EXPL: 1CVE-2020-6400 – chromium-browser: Inappropriate implementation in CORS
https://notcve.org/view.php?id=CVE-2020-6400
11 Feb 2020 — Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Una implementación inapropiada en CORS en Google Chrome versiones anteriores a 80.0.3987.87, permitió a un atacante remoto filtrar datos de origen cruzado por medio de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 80.0.3987.87. Issues addressed include information leakage, null ... • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html • CWE-203: Observable Discrepancy •
CVSS: 9.8EPSS: 43%CPEs: 26EXPL: 1CVE-2019-15605 – nodejs: HTTP request smuggling using malformed Transfer-Encoding header
https://notcve.org/view.php?id=CVE-2019-15605
07 Feb 2020 — HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed El tráfico no autorizado de peticiones HTTP en Node.js versiones 10, 12 y 13, causa la entrega maliciosa de la carga útil cuando la codificación de transferencia es malformada. A flaw was found in the Node.js code where a specially crafted HTTP(s) request sent to a Node.js server failed to properly process the HTTP(s) headers, resulting in a request smuggling attack. An attacker can use thi... • https://github.com/jlcarruda/node-poc-http-smuggling • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4088 – abrt: may leak some personal information to bugzilla with some certain applications
https://notcve.org/view.php?id=CVE-2011-4088
31 Jan 2020 — ABRT might allow attackers to obtain sensitive information from crash reports. ABRT podría permitir a atacantes obtener información confidencial de los reportes de fallos. • http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071027.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 75EXPL: 0CVE-2020-2654 – OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)
https://notcve.org/view.php?id=CVE-2020-2654
15 Jan 2020 — Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in th... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2020-2659 – OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795)
https://notcve.org/view.php?id=CVE-2020-2659
15 Jan 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vul... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 2%CPEs: 68EXPL: 0CVE-2020-2604 – OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)
https://notcve.org/view.php?id=CVE-2020-2604
15 Jan 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typi... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html • CWE-471: Modification of Assumed-Immutable Data (MAID) CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 75EXPL: 0CVE-2020-2583 – OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909)
https://notcve.org/view.php?id=CVE-2020-2583
15 Jan 2020 — Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embed... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html • CWE-755: Improper Handling of Exceptional Conditions CWE-770: Allocation of Resources Without Limits or Throttling •