CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-13800
https://notcve.org/view.php?id=CVE-2020-13800
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call. ati-vga en el archivo hw/display/ati.c en QEMU versión 4.2.0, permite a usuarios invitados del Sistema Operativo desencadenar una recursividad infinita por medio de un valor mm_index diseñado durante una llamada de ati_mm_read o ati_mm_write • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800 https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200717-0001 https://usn.ubuntu.com/4467-1 https://www.openwall.com/lists/oss-security/2020/06/04/2 • CWE-674: Uncontrolled Recursion •
CVSS: 9.3EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12406 – Mozilla: JavaScript Type confusion with NativeTypes
https://notcve.org/view.php?id=CVE-2020-12406
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. El desarrollador de Mozilla, Iain Ireland, detectó una falta de un tipo comprobación durante la eliminación de objetos sin caja, resultando en un bloqueo. Presumimos que con un esfuerzo suficiente podría ser explotado para ejecutar código arbitrario. • https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 https://usn.ubuntu.com/4421-1 https://www.mozilla.org/security/advisories/mfsa2020-20 https://www.mozilla.org/security/advisories/mfsa2020-21 https://www.mozilla.org/security/advisories/mfsa2020-22 https://access.redhat.com/security/cve/CVE-2020-12406 https://bugzilla.redhat.com/show_bug.cgi?id=1843312 • CWE-345: Insufficient Verification of Data Authenticity CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 1CVE-2020-12405 – Mozilla: Use-after-free in SharedWorkerService
https://notcve.org/view.php?id=CVE-2020-12405
When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Cuando se navega una página maliciosa, podría ocurrir una condición de carrera en nuestro SharedWorkerService y conllevar a un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 68.9.0, Firefox versiones anteriores a 77 y Firefox ESR versiones anteriores a 68.9 The Mozilla Foundation Security Advisory describes this flaw as: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. • https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 https://usn.ubuntu.com/4421-1 https://www.mozilla.org/security/advisories/mfsa2020-20 https://www.mozilla.org/security/advisories/mfsa2020-21 https://www.mozilla.org/security/advisories/mfsa2020-22 https://access.redhat.com/security/cve/CVE-2020-12405 https://bugzilla.redhat.com/show_bug.cgi?id=1843313 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-12410 – Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9
https://notcve.org/view.php?id=CVE-2020-12410
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Los desarrolladores de Mozilla reportaron bugs de seguridad de la memoria presentes en Firefox versión 76 y Firefox ESR versión 68.8. Algunos de estos bugs mostraron evidencia de corrupción de la memoria y presumimos que con suficiente esfuerzo algunos de estos podrían haber sido explotados para ejecutar código arbitrario. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://usn.ubuntu.com/4421-1 https://www.mozilla.org/security/advisories/mfsa2020-20 https://www.mozilla.org/security/advisories/mfsa2020-21 https://www.mozilla.org/security/advisories/mfsa2020-22 https://access.redhat.com/security/cve/CVE-2020-12410 https://bugzilla.redhat.com/show_bug.cgi?id=1843030 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 1%CPEs: 13EXPL: 0CVE-2020-13596
https://notcve.org/view.php?id=CVE-2020-13596
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. Se detectó un problema en Django versiones 2.2 anteriores a 2.2.13 y versiones 3.0 anteriores a 3.0.7. En casos donde un backend memcached no lleva a cabo una comprobación de la clave, pasa claves de caché maliciosas que podría resultar en una colisión de claves y una potencial filtración de datos. • https://docs.djangoproject.com/en/3.0/releases/security https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ https://security.netapp.com/advisory/ntap-20200611-0002 https://usn.ubuntu.com/4381-1 https://usn.ubuntu.com/4381-2 https://www.debian.org/security/2020/dsa-4705 https://www.djangoproject.com/weblog/2020/jun/03/security-releases https& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •