CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0CVE-2019-16168 – sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c
https://notcve.org/view.php?id=CVE-2019-16168
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." En SQLite versiones hasta 3.29.0, la función whereLoopAddBtreeIndex en el archivo sqlite3.c puede bloquear un navegador u otra aplicación debido a la falta de comprobación de un campo sqlite_stat1 sz, también se conoce como "severe division by zero in the query planner.". • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html https://kc.mcafee.com/corporate/index?page=content&id=SB10365 https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2 https://security.gentoo.org/glsa/202003-16 https://security.netapp.com/advisory/ntap-20190926-0003 https:/& • CWE-369: Divide By Zero •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3592 – MA for Windows update addresses weak directory permissions
https://notcve.org/view.php?id=CVE-2019-3592
Privilege escalation vulnerability in McAfee Agent (MA) before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory. La vulnerabilidad de escalada de privilegios en McAfee Agent (MA) antes de 5.6.1 HF3, permite a los usuarios de administradores locales potencialmente deshabilitar algunos procesos de McAfee al manipular el control de directorio de MA y colocar un archivo cuidadosamente construido en el directorio de MA. • https://kc.mcafee.com/corporate/index?page=content&id=SB10288 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3599 – McAfee Agent update fixes an Information Disclosure vulnerability
https://notcve.org/view.php?id=CVE-2019-3599
Information Disclosure vulnerability in Remote logging (which is disabled by default) in McAfee Agent (MA) 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled. Una vulnerabilidad de divulgación de información en el registro remoto (deshabilitado por defecto) en McAfee Agent (MA) 5.x permite a los usuarios remotos no autenticados acceder a información sensible mediante un registro remoto cuando éste está habilitado. • https://kc.mcafee.com/corporate/index?page=content&id=SB10271 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3598 – McAfee Agent update fixes a vulnerability in handling UDP requests
https://notcve.org/view.php?id=CVE-2019-3598
Buffer Access with Incorrect Length Value in McAfee Agent (MA) 5.x allows remote unauthenticated users to potentially cause a denial of service via specifically crafted UDP packets. Un acceso de búfer con valor de longitud incorrecto en McAfee Agent (MA) 5.x podría permitir a los usuarios remotos no autenticados provocar una denegación de servicio (DoS) mediante paquetes UDP especialmente manipulados. • http://www.securityfocus.com/bid/107205 https://kc.mcafee.com/corporate/index?page=content&id=SB10272 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 1%CPEs: 180EXPL: 0CVE-2019-1559 – 0-byte record padding oracle
https://notcve.org/view.php?id=CVE-2019-1559
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html http://www.securityfocus.com/bid/107174 https://access. • CWE-203: Observable Discrepancy CWE-325: Missing Cryptographic Step •