CVE-2020-11022

CVE-2020-11022 affects jQuery versions >=1.2 and =3.5.0 or apply vendor guidance where applicable.

CVE-2020-11023

The connected Astra Linux bulletin confirms CVE-2020-11023: in jQuery versions >= 1.0.3 and < 3.5.0, passing HTML containing elements from untrusted sources to DOM manipulation methods (e.g., .html(), .append()) may lead to untrusted code execution. Patch released in jQuery 3.5.0. Remediat...

CVE-2020-1971

CVE-2020-1971 is described across multiple connected sources as a NULL-dereference in OpenSSL’s GENERAL_NAME_cmp when EDIPARTYNAME is present, potentially enabling a denial-of-service crash. Affected OpenSSL versions include all 1.1.1 and 1.0.2 lines; fixes are published in OpenSSL 1.1.1i and Ope...

CVE-2020-2574

CVE-2020-2574 affects the Oracle MySQL Client (C API). Affected: MySQL Client in Oracle MySQL releases 5.6.46 and earlier, 5.7.28 and earlier, and 8.0.18 and earlier. Description in the sources: vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause a...

CVE-2020-1967

CVE-2020-1967 describes a NULL pointer dereference in OpenSSL’s SSL_check_chain() during or after a TLS 1.3 handshake, caused by incorrect handling of the signature_algorithms_cert extension. A malicious peer sending an invalid/unrecognized signature algorithm can crash the server/client, enablin...

CVE-2020-2752

CVE-2020-2752 affects the Oracle MySQL Client (C API). Publicly documented affected versions are 5.6.47 and earlier, 5.7.27 and earlier, and 8.0.17 and earlier. The vulnerability can be triggered by a network-accessing attacker via multiple protocols with low privileges and may lead to a Hang or ...

CVE-2020-2760

CVE-2020-2760 affects MySQL Server (InnoDB) with affected versions 5.7.29 and prior, and 8.0.19 and prior. It enables a high-privilege attacker with network access to cause a hang or crash (DoS) and potentially unauthorized data updates/inserts/deletes. The ALAS advisory shows remediation through...

CVE-2020-2922

CVE-2020-2922 affects the MySQL Client C API in Oracle MySQL. Affected versions are 5.6.47 and prior, 5.7.29 and prior, and 8.0.18 and prior. It is difficult to exploit and can allow an unauthenticated attacker with network access via multiple protocols to read a subset of MySQL Client data. CVSS...

CVE-2020-2812

CVE-2020-2812 affects the MySQL Server component (Server: Stored Procedure). Affected are MySQL/MariaDB builds with versions 5.6.47 and earlier, 5.7.29 and earlier, and 8.0.19 and earlier. The vulnerability can allow a high-privilege attacker with network access via multiple protocols to cause a ...

CVE-2020-14812

CVE-2020-14812 affects Oracle MySQL Server (component: Server: Locking) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. Exploitation can lead to a hang or frequent crashes (DoS) with network access. Remediation status varies by distribution; Debian LTS notes a fix...

CVE-2020-14765

An advisory indicates CVE-2020-14765 affects Oracle MySQL Server (Server: FTS) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. The cited materials describe a vulnerability that can cause the MySQL Server to hang or crash (DoS) via network access, but the root caus...

CVE-2020-28196

CVE-2020-28196 affects MIT Kerberos 5 (krb5) prior to 1.17.2 and 1.18.x prior to 1.18.3. The vulnerability stems from unbounded recursion in the ASN.1 BER decoder (lib/krb5/asn.1/asn1_encode.c) due to no recursion limit for indefinite lengths. This can lead to denial of service due to resource ex...

CVE-2020-2780

CVE-2020-2780 affects Oracle MySQL Server (Server: DML) with vulnerable ranges: 5.6.47 and earlier, 5.7.29 and earlier, and 8.0.19 and earlier. The issue allows a low-privileged, network-access attacker to cause a hang or crash (DOS) via multiple protocols. The connected advisories (e.g., ALAS/ C...

CVE-2020-14550

CVE-2020-14550 affects the MySQL Client (C API) in Oracle MySQL. Affected are 5.6.48 and earlier, 5.7.30 and earlier, and 8.0.20 and earlier. The vulnerability allows a low-privilege, network-accessible attacker via multiple protocols to cause a hang or a frequent, crashable DoS of the MySQL Clie...

CVE-2020-14776

CVE-2020-14776 affects MySQL (InnoDB) with vulnerable ranges of 5.7.31 and earlier, and 8.0.21 and earlier. The vulnerability can be exploited by a high-privilege attacker with network access via multiple protocols to cause a hang or a complete DoS of MySQL Server. Connected documents confirm thi...

CVE-2020-2814

CVE-2020-2814 affects Oracle MySQL Server (InnoDB) with affected versions 5.6.47 and prior, 5.7.28 and prior, and 8.0.18 and prior. Bulletins in connected advisories describe an easily exploitable, network-accessible vulnerability enabling a high-privilege attacker to cause a hang or frequent cra...

CVE-2020-14789

CVE-2020-14789 affects Oracle MySQL Server (component: Server: FTS). Vulnerability details in connected advisories show it impacts MySQL 5.7.31 and prior and 8.0.21 and prior, with an attacker having network access via multiple protocols and high privileges able to cause a hang or crash (DoS) of ...

CVE-2020-14556

CVE-2020-14556 and related CVEs (e.g., 14577, 14578, 14579, 14581, 14583, 14593, 14621, 14664) pertain to Oracle Java SE/OpenJDK/OpenJDK-derived runtimes across multiple components (Libraries, JSSE, 2D, JAXP, JavaFX, etc.). The primary 2020 issue affects Java SE and Java SE Embedded on various ve...

CVE-2020-2579

CVE-2020-2579 is a MySQL Server vulnerability in the optimizer component. Affected versions are 5.6.46 and earlier, 5.7.28 and earlier, and 8.0.18 and earlier. An attacker with network access over multiple protocols and low privileges can trigger a hang or a complete denial of service (DoS) via t...

CVE-2020-2759

CVE-2020-2759 affects Oracle MySQL Server (Server: Replication) with affected versions 8.0.19 and earlier. The vulnerability is exploitable over the network via multiple protocols and can lead to a hang or repeated crashes (high-availability Denial of Service) as described in the CVE entry. Conne...

CVE-2020-2679

CVE-2020-2679 affects Oracle MySQL Server (Server: Optimizer). Affected versions are 8.0.18 and earlier. The vulnerability can be exploited via network to cause a hang or frequent crash (DoS) of MySQL Server, with attack potential described as high-privilege, remote. The attached connected adviso...

CVE-2020-14621

CVE-2020-14621 details (connected data) : The vulnerability concerns Oracle Java SE/OpenJDK JAXP in Java SE/Embedded. Affected versions include Java SE: 7u261, 8u251, 11.0.7, 14.0.1; Java SE Embedded: 8u251. The issue is described as an easily exploitable flaw in the JAXP component that allows an...

CVE-2020-2589

CVE-2020-2589 is a vulnerability in Oracle MySQL Server (InnoDB) affecting 5.7.28 and earlier and 8.0.17 and earlier. The issue can allow a high-privilege attacker with network access via multiple protocols to cause a hang or repeated crashes (complete DOS) of MySQL Server, with an availability i...

CVE-2020-2590

CVE-2020-2590 is an OpenJDK/Oracle Java SE vulnerability in the Security component (Kerberos interop) affecting Java SE and Java SE Embedded across multiple versions. Public descriptions indicate unauthenticated remote access via network and potential unauthorized data updates/deletes; CVSS 3.0 b...

CVE-2020-14576

CVE-2020-14576 affects Oracle MySQL Server (component: Server: UDF). Affected versions are MySQL 5.7.30 and earlier, and 8.0.20 and earlier. The vulnerability enables a low-privilege, network-access attacker to cause a hang or frequent crashes (complete DoS) via multiple protocols. The CVSS3.1 ba...

CVE-2020-14775

CVE-2020-14775 affects Oracle MySQL Server InnoDB. Affects MySQL Server versions 5.7.31 and earlier and 8.0.21 and earlier; exploitation can cause the server to hang or crash (DoS) via network access across multiple protocols. Remediation in public advisories includes upgrading to fixed releases:...

CVE-2020-2572

CVE-2020-2572 affects Oracle MySQL Server, specifically the Server: Audit Plugin. Affected versions: MySQL 5.7.28 and earlier, and 8.0.18 and earlier. Root cause: vulnerability in the Audit Plugin that can be exploited remotely by a high-privilege, unauthenticated attacker to potentially update/i...

CVE-2020-2654

CVE-2020-2654 affects Oracle Java SE Libraries in Java SE 7u241, 8u231, 11.0.5 and 13.0.1 (Java SE and Java SE Embedded) with the issue described as an unauthenticated network-access vulnerability that can cause a partial denial of service. The root cause is tied to the Libraries component (with ...

CVE-2020-14577

CVE-2020-14577 is a TLS/JSSE-related issue in Oracle Java SE and Java SE Embedded (affecting Java 7u261, 8u251, 11.0.7 and 14.0.1; Embedded 8u251) enabling unauthenticated network access to read some data. Connected advisories show vendor-specific mitigations: for example, Amazon Linux ALAS advis...

CVE-2020-14798

CVE-2020-14798 is a vulnerability in Oracle Java SE Libraries affecting Java SE versions 7u271, 8u261, 11.0.8 and 15, and Java SE Embedded 8u261. Exploitation is possible over network with multiple protocols and does not require authentication, but requires user interaction. Impact described as p...

CVE-2020-14785

CVE-2020-14785 affects Oracle MySQL Server (Server: Optimizer) with vulnerable versions up to 8.0.21 and earlier. The issue allows a high-privilege attacker who can reach the server over multiple network protocols to cause the MySQL Server to hang or crash, producing a denial of service. Practica...

CVE-2020-14697

CVE-2020-14697 affects Oracle MySQL MySQL Server (Server: Security: Privileges). Affected versions are 8.0.20 and earlier. The vulnerability is described as easily exploitable with network access via multiple protocols, allowing a high-privilege attacker to take over MySQL Server. Public referenc...

CVE-2020-14781

CVE-2020-14781 affects Oracle Java SE/SE Embedded (JNDI) with affected versions including Java SE 7u271, 8u261, 11.0.8, 15 and Java SE Embedded 8u261. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to read a subset of Java SE/SE Embedded data. The ...

CVE-2020-2573

CVE-2020-2573 affects Oracle MySQL’s C API client. Affects: MySQL Client, versions 5.7.28 and earlier, and 8.0.18 and earlier. Root cause: a vulnerability in the C API that allows an unauthenticated, network-based attacker access via multiple protocols to cause a hang or frequent, repeatable cras...

CVE-2020-14581

CVE-2020-14581 affects Oracle Java SE/Java SE Embedded (component: 2D) with affected versions Java SE: 8u251, 11.0.7, 14.0.1 and Java SE Embedded: 8u251. The CVE is listed with a low overall base score (CVSS 3.1: 3.7) and confidentiality impact (C:L) and no impact on integrity/availability (I:N/A...

CVE-2020-2765

CVE-2020-2765 is a vulnerability in Oracle MySQL Server, specifically the Server: Optimizer component. Affected versions are MySQL 5.7.29 and earlier, and 8.0.19 and earlier. The issue can be exploited with network access via multiple protocols by a high-privilege attacker to cause a hang or a co...

CVE-2020-14663

CVE-2020-14663 affects Oracle MySQL Server (component: Server: Security: Privileges). Affected: MySQL 8.0.20 and earlier. Root cause: privilege escalation through the Server security subsystem allowing a high-privilege attacker to compromise the MySQL Server over network via multiple protocols. I...

CVE-2020-14773

CVE-2020-14773 affects Oracle MySQL Server (Server: Optimizer). Affected versions: 8.0.21 and earlier. An attacker with high privileges and network access via multiple protocols can trigger a hang or crash (DoS) of MySQL Server. The entry does not describe specific exploit vectors or affected con...

CVE-2020-14867

CVE-2020-14867 affects Oracle MySQL Server (Server: DDL). Affected versions are 5.6.49 and earlier, 5.7.31 and earlier, and 8.0.21 and earlier. The vulnerability can be exploited by a highly privileged attacker with network access via multiple protocols to cause the MySQL Server to hang or crash ...

CVE-2020-14567

CVE-2020-14567 affects MySQL Server (Replication) and can be exploited over the network by a high-privilege attacker to cause a complete DoS via hangs/crashes. Public sources in connected docs confirm the issue across multiple distributions and indicate patches exist; applying vendor advisories/u...

CVE-2020-2923

CVE-2020-2923 affects Oracle MySQL Server, component Server: Optimizer, with affected versions 8.0.19 and earlier. The vulnerability allows a high-privileged attacker who can access the service over network through multiple protocols to cause a hang or crash (Denial of Service). The connected Alm...

CVE-2020-2803

CVE-2020-2803 affects OpenJDK (Libraries component, Java SE/OpenJDK). The connected document confirms a vulnerability in boundary checks of java.nio buffer classes that allows an untrusted Java applet/application to bypass Java sandbox restrictions. Affected versions align with the original descr...

CVE-2020-14777

Oracle MySQL Server vulnerability CVE-2020-14777 affects the Server: Optimizer in MySQL 8.0.21 and earlier. An attacker with network access via multiple protocols and high privileges can cause the server to hang or crash (DoS). Affected product/version details are supported in connected documents...

CVE-2020-14779

CVE-2020-14779 affects Oracle Java SE SE/Embedded with Serialization and can enable an unauthenticated network-based attacker to cause partial denial of service. Affected versions include Java SE 7u271, 8u261, 11.0.8, 15 and Java SE Embedded 8u261; attack surface covers client and server deployme...

CVE-2020-14803

CVE-2020-14803 affects Oracle Java SE Libraries in Java SE 11.0.8 and 15. The vulnerability allows an unauthenticated attacker over network to read a subset of Java SE data due to an issue in Libraries handling, per the CVSS base score 5.3 (CONF). Affected advisories across platforms corroborate ...

CVE-2020-14539

CVE-2020-14539 affects Oracle MySQL Server (Server: Optimizer) with vulnerable versions 5.6.48 and earlier, 5.7.30 and earlier, and 8.0.20 and earlier. Exploitation can cause a hang or crash (DoS) with network access via multiple protocols. Cited connected advisories recommend upgrading to non-vu...

CVE-2020-2686

CVE-2020-2686 affects Oracle MySQL Server, specifically the Server: Optimizer component. Affected versions are 8.0.18 and earlier. The vulnerability allows a low-privileged attacker with network access via multiple protocols to potentially cause a hang or a frequently repeating crash (complete DO...

CVE-2020-2804

CVE-2020-2804 affects Oracle MySQL Server, component Server: Memcached . Affected versions include 5.6.47 and earlier, 5.7.29 and earlier, and 8.0.19 and earlier. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause a hang or crash (complete DOS...

CVE-2020-14844

CVE-2020-14844 affects Oracle MySQL Server (Server: PS) in 8.0.21 and earlier. An attacker with network access across multiple protocols could exploit this to cause a hang or crash (DoS). CVSS 3.1 base score 4.9 (Availability). Remediation mentioned in connected docs: upgrade to MySQL 8.0.26 or n...

CVE-2020-2893

CVE-2020-2893 is an Oracle MySQL InnoDB vulnerability affecting 8.0.19 and earlier. An attacker with network access and high privileges can cause a hang or crash (denial of service) via multiple protocols. Connected sources enumerate this issue under MySQL Server/InnoDB and corroborate the 4.9 CV...