CVE-2020-11023

The connected Astra Linux bulletin confirms CVE-2020-11023: in jQuery versions >= 1.0.3 and < 3.5.0, passing HTML containing elements from untrusted sources to DOM manipulation methods (e.g., .html(), .append()) may lead to untrusted code execution. Patch released in jQuery 3.5.0. Remediat...

CVE-2018-8014

CVE-2018-8014 affects the default configuration of Tomcat’s CORS filter, where default settings enable supportsCredentials for all origins across multiple releases (9.0.0.M1–9.0.8, 8.5.0–8.5.31, 8.0.0.RC1–8.0.52, 7.0.41–7.0.88). The issue is that environments relying on the default CORS configura...

CVE-2020-14789

CVE-2020-14789 affects Oracle MySQL Server (component: Server: FTS). Vulnerability details in connected advisories show it impacts MySQL 5.7.31 and prior and 8.0.21 and prior, with an attacker having network access via multiple protocols and high privileges able to cause a hang or crash (DoS) of ...

CVE-2020-14775

CVE-2020-14775 affects Oracle MySQL Server InnoDB. Affects MySQL Server versions 5.7.31 and earlier and 8.0.21 and earlier; exploitation can cause the server to hang or crash (DoS) via network access across multiple protocols. Remediation in public advisories includes upgrading to fixed releases:...

CVE-2020-14672

The CVE-2020-14672 issue affects Oracle MySQL Server (Server: Stored Procedure) and impacts MySQL Server versions 5.6.49 and earlier, 5.7.31 and earlier, and 8.0.21 and earlier. It can be triggered by a network-accessible attacker to cause a hang or a frequent crash (DoS). The vulnerability arise...

CVE-2020-14777

Oracle MySQL Server vulnerability CVE-2020-14777 affects the Server: Optimizer in MySQL 8.0.21 and earlier. An attacker with network access via multiple protocols and high privileges can cause the server to hang or crash (DoS). Affected product/version details are supported in connected documents...

CVE-2020-14790

Oracle MySQL Server (Server: PS) is affected in 5.7.31 and earlier and 8.0.21 and earlier. An attacker with network access via multiple protocols can exploit this to cause the server to hang or crash (DoS). Public details show suggested fixes via upgrading to newer MySQL versions (e.g., MySQL 8.0...

CVE-2020-14773

CVE-2020-14773 affects Oracle MySQL Server (Server: Optimizer). Affected versions: 8.0.21 and earlier. An attacker with high privileges and network access via multiple protocols can trigger a hang or crash (DoS) of MySQL Server. The entry does not describe specific exploit vectors or affected con...

CVE-2020-14769

CVE-2020-14769 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 5.6.49 and prior, 5.7.31 and prior, 8.0.21 and prior. The vulnerability in the Optimizer can be exploited by a low-privilege, network-contact attacker to cause the server to hang or crash (DoS). CVSSv3.1 base score 6....

CVE-2020-14785

CVE-2020-14785 affects Oracle MySQL Server (Server: Optimizer) with vulnerable versions up to 8.0.21 and earlier. The issue allows a high-privilege attacker who can reach the server over multiple network protocols to cause the MySQL Server to hang or crash, producing a denial of service. Practica...

CVE-2020-14794

CVE-2020-14794 affects Oracle MySQL Server 8.0.21 and earlier (Server: Optimizer). The vulnerability can cause the server to hang or crash, enabling a high-privilege attacker with network access to trigger a complete DoS. Public sources in the connected set corroborate the issue and identify the ...

CVE-2020-14799

CVE-2020-14799 is a vulnerability in the Oracle MySQL Server product (component: Server: Security: Encryption) affecting versions 8.0.20 and earlier. The issue allows a high-privileged attacker who has network access via multiple protocols to cause a hang or crash of MySQL Server, resulting in a ...

CVE-2020-14800

Summary: CVE-2020-14800 affects Oracle MySQL Server (component: Server: Security: Encryption). Affected versions: 8.0.21 and earlier. The vulnerability could allow a low-privileged, network-accessible attacker to cause a hang or crash (DoS) of MySQL Server. There is no public exploitation detail ...

CVE-2020-14786

CVE-2020-14786 affects Oracle MySQL Server (Server: PS) with affected versions 8.0.21 and earlier. A high-privilege attacker with network access via multiple protocols can cause a hang or frequent crashes (DoS). Some public advisories indicate a fix exists in newer MySQL releases (e.g., upgrades ...

CVE-2020-14793

CVE-2020-14793 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 5.6.49 and earlier, 5.7.31 and earlier, 8.0.21 and earlier. Exploitation requires network access, potentially via multiple protocols, with high privileges to cause a hang or crash (DoS). Connected advisories confirm m...

CVE-2020-14791

CVE-2020-14791 affects Oracle MySQL Server (InnoDB) with versions 8.0.21 and earlier. The vulnerability is exploitable over network via multiple protocols to high-privilege attackers and can cause partial denial of service on MySQL Server. Public documentation confirms the flaw and associated imp...

CVE-2016-8610

CVE-2016-8610 is a denial-of-service flaw in OpenSSL affecting TLS/SSL alert packet processing during handshakes. The issue exists in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0, enabling a remote attacker to cause high CPU usage and denial of service by sending many alert messages. Con...

CVE-2018-5482

NetApp SnapCenter Server prior to 4.1 is affected by a vulnerability where a sensitive cookie is not secured with the Secure flag in HTTPS sessions, potentially allowing the cookie to be transmitted in cleartext over an unencrypted channel. Root cause: missing Secure attribute on a sensitive cook...

CVE-2017-15516

NetApp SnapCenter Server versions 1.1–2.x are vulnerable to Cross-Site Request Forgery (CSRF) that can cause unintended authenticated actions in the UI. The issue is caused by CSRF in the server’s web interface, enabling an attacker to exploit a user’s authenticated session to perform actions wit...

CVE-2017-15515

NetApp SnapCenter Server prior to version 4.0 is affected by a cross-site scripting (XSS) vulnerability in the custom secondary policy label field. The issue is documented under CVE-2017-15515 and appears in multiple feeds (NVD, CVE List, CNVD). Impact stated in the sources: a privileged attacker...

CVE-2016-1502

CVE-2016-1502 affects NetApp SnapCenter Server versions 1.0 and 1.0P1, where an attacker can remotely bypass authentication and subsequently list and delete backups via unspecified vectors. The NVD entry rates this as HIGH (CVSSv3 base 7.3) with network attack vector, no privileges required, and ...

CVE-2017-15519

NetApp SnapCenter Server (versions 2.0–3.0.1) is affected by a vulnerability via the NAS File Services plug-in that allows unauthenticated remote attackers to view and modify backup-related data. The root cause is exposure through the Plug-in for NAS File Services, enabling data exposure and back...

CVE-2015-7887

NetApp SnapCenter Server 1.0 is affected by CVE-2015-7887. The issue is an authentication bypass that permits remote authenticated users to list and delete backups. The vulnerability is documented across multiple sources (NVD entry for CVE-2015-7887 and related CNVD/CVE records), indicating a ser...