UBUNTU-CVE-2020-25695

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest...

UBUNTU-CVE-2020-25696

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating...

CVE-2020-8569

A flaw was found in the Kubernetes snapshot-controller, where it is vulnerable to a denial of service attack via authorized API requests. The snapshot-controller can dereference a NULL pointer when processing a VolumeSnapshot custom resource via an authorized API request with invalid references t...

CVE-2020-25694

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

CVE-2020-7768

A flaw was found in nodejs-grpc, where the package @grpc/grpc-js is vulnerable to Prototype Pollution via the loadPackageDefinition. The highest threat from this vulnerability is to system availability...

nodejs-dot-prop: prototype pollution

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well a...

Oracle Linux 7 : kernel (ELSA-2020-5023)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5023 advisory. - net bluetooth: l2cap: Fix calling skfilter on non-socket based channel Gopal Tiwari 1888253 CVE-2020-12351 - net bluetooth: a2mp: Fix not initializin...

Oracle Linux 8 : libldb (ELSA-2020-4568)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4568 advisory. - Resolves: rhbz1849615 - Fix CVE-2020-10730 use-after-free Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 7 : libvirt (ELSA-2020-5040)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5040 advisory. - rpc: gendispatch: handle empty flags CVE-2020-25637 - rpc: add support for filtering @acls by uint params CVE-2020-25637 - rpc: require write acl for guest...

CVE-2020-25708

A divide by zero flaw was found in libvncserver. This flaw allows a malicious client to send a specially crafted message that, when processed by the VNC server, leads to a floating-point exception, resulting in a denial of service. The highest threat from this vulnerability is to system...

PT-2020-4890

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 13.1 PostgreSQL versions prior to 12.5 PostgreSQL versions prior to 11.10 PostgreSQL versions prior to 10.15 PostgreSQL versions prior to 9.6.20 PostgreSQL versions prior to 9.5.24 Description: A flaw was found in...

bind: remotely triggerable assertion failure in pk11.c

A flaw was found in bind. An assertion failure can occur when a specially crafted query for a zone signed with an RSA key. BIND must be compiled with "--enable-native-pkcs11" for the system to be affected. The highest threat from this vulnerability is to system availability...

KLA12001 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2020-25704

A memory leak flaw was found in the Linux kernel’s performance monitoring subsystem when using PERFEVENTIOCSETFILTER. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability. Mitigation Mitigation for...

CVE-2020-25592

A flaw was found in salt. Invalid eauth credentials and tokens are not handled correctly when calling Salt SSH via the salt-api which could allow an attacker to bypass authentication and gain access to restricted information or to possibly conduct further attacks. The highest threat from this...

CVE-2020-16846

A flaw was found in salt. A shell injection vulnerability was found where an unauthenticated user with network access to the Salt API can use shell injections to run code on the Salt-API using the SSH client. An attacker could use this flaw to cause a denial of service, information disclosure, or...

Oracle Linux 7 : xorg-x11-server (ELSA-2020-4910)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4910 advisory. - CVE fixes for: CVE-2020-14345 1872389, CVE-2020-14346 1872393, CVE-2020-14361 1872400, CVE-2020-14362 1872407 Tenable has extracted the preceding...

Oracle Linux 6 : xorg-x11-server (ELSA-2020-4953)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4953 advisory. 1.17.4-18.0.1 - Fix regression from the patch for Orabug 27204421 which crashes Xvfb Orabug: 28485058 - Fix X consumes 100% CPU if messagebus restarted...

CVE-2020-25661

A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on...

Design/Logic Flaw

A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on...