CVE-2020-13333

A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage...

CVE-2020-13333

Removed by vendor...

mysql: InnoDB unspecified vulnerability (CPU Oct 2019)

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

Cisco IOS XE Software Split DNS DoS (cisco-sa-splitdns-SPWqpdGW)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability as the Split DNS feature's regular expression regex engine may time out when processing the DNS name list configuration. An unauthenticated, remote attacker could cause an affected...

Moderate: Red Hat Security Advisory: spamassassin security update

An update for spamassassin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Moderate: Red Hat Security Advisory: subversion security update

An update for subversion is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-pillow (EulerOS-SA-2020-2024)

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.CVE-2020-5311 - In...

Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..

...

Race condition

A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service DoS condition on the device. The vulnerability is due to insufficient...

CVE-2020-3429 Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family WPA Denial of Service Vulnerability

A vulnerability in the WPA2 and WPA3 security implementation of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause denial of service DoS condition on an affected device. The vulnerability is due to incorrect pack...

PT-2020-4184 · Cisco · Cisco Ios Xe +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software and Cisco IOS XE Software affected versions not specified Description: A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an...

Atlassian Jira < 7.13.16 / 8.x < 8.5.7 / 8.6.x < 8.10.2 / 8.11.x < 8.11.1 DoS (JRASERVER-71388)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.3.16, or is 8.x 8.5.7, 8.6.x 8.10.2, or 8.11.x 8.11.0. It is, therefore, affected by a regex-based denial of service DoS vulnerability in JQL version searching. A remote,...

ALPINE-CVE-2020-25601

An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchnreset / evtchndestroy. In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these when resetting all event channels or when cleaning...

Design/Logic Flaw

An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEMacquireresource error path. The RCU Read, Copy, Update mechanism is a synchronisation primitive. A buggy error path in the XENMEMacquireresource exits without releasing an RCU reference, which is conceptually similar to...

CVE-2019-16023

Multiple vulnerabilities in the implementation of Border Gateway Protocol BGP Ethernet VPN EVPN functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerabilities are due to incorrect processing of BGP update...

CVE-2020-14177

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service DoS vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from versi...

FreeBSD : Node.js -- September 2020 Security Releases (4ca5894c-f7f1-11ea-8ff8-0022489ad614)

Node.js reports : Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion High CVE-2020-8201 Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing...

ModSecurity 3.0.x Denial Of Service Vulnerability

ModSecurity version 3.0.x suffers from a denial of service vulnerability due to the handling of regular expression matching. ModSecurity version 3.0.x is affected by a denial of service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular...

mysql: Server: C API unspecified vulnerability (CPU Oct 2019)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: C API. Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...

Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers < 1.0.03.18 SSL DoS (cisco-sa-sb-dos-ZN5GvNH7)

According to its self-reported version, Cisco Small Business RV Series Router Firmware is prior to 1.0.03.18. It is, therefore, affected by a DoS vulnerability in the Secure Sockets Layer SSL VPN feature due to a lack of proper validation of HTTP requests. An unauthenticated, remote attacker coul...