CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-17361
https://notcve.org/view.php?id=CVE-2019-17361
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host. En SaltStack Salt hasta 2019.2.0, la API NET de salt-api con el cliente ssh habilitado es vulnerable a la inyección de comandos. Esto permite que un atacante no autenticado con acceso de red al punto final de la API ejecute código arbitrario en el host salt-api. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00026.html https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix https://github.com/saltstack/salt/commits/master https://usn.ubuntu.com/4459-1 https://www.debian.org/security/2020/dsa-4676 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-2686 – mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2020)
https://notcve.org/view.php?id=CVE-2020-2686
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). • https://security.gentoo.org/glsa/202105-27 https://security.netapp.com/advisory/ntap-20200122-0002 https://usn.ubuntu.com/4250-1 https://www.oracle.com/security-alerts/cpujan2020.html https://access.redhat.com/security/cve/CVE-2020-2686 https://bugzilla.redhat.com/show_bug.cgi?id=1796888 •
CVSS: 3.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-2694 – mysql: Server: Information Schema unspecified vulnerability (CPU Jan 2020)
https://notcve.org/view.php?id=CVE-2020-2694
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.18 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). • https://security.gentoo.org/glsa/202105-27 https://security.netapp.com/advisory/ntap-20200122-0002 https://usn.ubuntu.com/4250-1 https://www.oracle.com/security-alerts/cpujan2020.html https://access.redhat.com/security/cve/CVE-2020-2694 https://bugzilla.redhat.com/show_bug.cgi?id=1796889 •
CVSS: 4.9EPSS: 0%CPEs: 9EXPL: 0CVE-2020-2679 – mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2020)
https://notcve.org/view.php?id=CVE-2020-2679
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). • https://security.gentoo.org/glsa/202105-27 https://security.netapp.com/advisory/ntap-20200122-0002 https://usn.ubuntu.com/4250-1 https://www.oracle.com/security-alerts/cpujan2020.html https://access.redhat.com/security/cve/CVE-2020-2679 https://bugzilla.redhat.com/show_bug.cgi?id=1796887 •
CVSS: 4.9EPSS: 0%CPEs: 10EXPL: 0CVE-2020-2660 – mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2020)
https://notcve.org/view.php?id=CVE-2020-2660
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). • https://security.gentoo.org/glsa/202105-27 https://security.netapp.com/advisory/ntap-20200122-0002 https://usn.ubuntu.com/4250-1 https://www.oracle.com/security-alerts/cpujan2020.html https://access.redhat.com/security/cve/CVE-2020-2660 https://bugzilla.redhat.com/show_bug.cgi?id=1796886 •