The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory.

  - In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some     operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in     fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to     a right data structure. (CVE-2019-19448)

  - A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file     system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash     the system if the directory exists. The highest threat from this vulnerability is to system availability.
    (CVE-2020-14314)

  - A flaw was found in the Linux kernels implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

  - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers     to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452. (CVE-2020-25212)

  - A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified     other impact, aka CID-17743798d812. (CVE-2020-25285)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1489 advisory.

  - In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to     cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME     parts. (CVE-2020-12100)

  - In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because     of an out-of-bounds read. (CVE-2020-12673)

  - In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because     a length of zero is mishandled. (CVE-2020-12674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1493 advisory.

  - Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on     certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent     use of memory pools. Configuring the LogLevel of mod_http2 above info will mitigate this vulnerability     for unpatched servers. (CVE-2020-11993)

  - Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a     HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource     afterwards. Configuring the HTTP/2 feature via H2Push off will mitigate this vulnerability for unpatched     servers. (CVE-2020-9490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1492 advisory.

  - ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as     demonstrated by getlocal(3,2^31). (CVE-2020-24370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1433 advisory.

  - A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2     could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected     device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this     vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to     cause the ClamAV scanning process crash, resulting in a denial of service condition. (CVE-2020-3327)

  - A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an     authenticated, local attacker to cause the running software to delete arbitrary files on the system. The     vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with     local shell access could exploit this vulnerability by executing a script that could trigger the race     condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the     attacker would not normally have privileges to delete, producing system instability or causing the     endpoint software to stop working. (CVE-2020-3350)

  - A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 -     0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an     affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this     vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to     cause the ClamAV scanning process crash, resulting in a denial of service condition. (CVE-2020-3481)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1434 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client     and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-14556)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2020-14577)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and     server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-14578, CVE-2020-14579)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability     does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code     installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). (CVE-2020-14583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N). (CVE-2020-14593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1     Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
    (CVE-2020-14621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1430 advisory.

  - An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally     to cause denial of service or local privilege escalation from unprivileged processes or from containers     with the CAP_NET_RAW capability enabled. (CVE-2020-14386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1488 advisory.

  - An issue has been reported in the Linux kernel's handling of raw sockets. This issue can be used locally     to cause denial of service or local privilege escalation from unprivileged processes or from containers     with the CAP_NET_RAW capability enabled. (CVE-2020-14386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1432 advisory.

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. (CVE-2020-14422)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1431 advisory.

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1486 advisory.

  - This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid     Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability.
    The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger     the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-     service condition to users of the system. Was ZDI-CAN-6088. (CVE-2018-1172)

  - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of     sensitive information from heap memory, such as information associated with other users' sessions or non-     Squid processes. (CVE-2019-12528)

  - An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is     vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the     raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR     protections and may aid attackers isolating memory areas to target for remote code execution attacks.
    (CVE-2019-18679)

  - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can     cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1483 advisory.

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1485 advisory.

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1487 advisory.

  - By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a     cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability     affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird <     78.1. (CVE-2020-15652)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR     78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox     ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. (CVE-2020-15659)

  - Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6463)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a     privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
    (CVE-2020-6514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1484 advisory.

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. (CVE-2020-14422)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1482 advisory.

  - PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. (CVE-2020-13692)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1422 advisory.

  - jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function     does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery     determined whether the input was HTML by looking for the '<' character anywhere in the string, giving     attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery     only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability     only to attackers who can control the beginning of a string, which is far less common. (CVE-2012-6708)

  - The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to     cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a     crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as     demonstrated by conducting a SQL injection attack against Ruby on Rails, aka Unsafe Object Creation     Vulnerability. (CVE-2013-0269)

  - jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request     is performed without the dataType option, causing text/javascript responses to be executed.
    (CVE-2015-9251)

  - Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows     an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response     for the HTTP server of WEBrick. (CVE-2017-17742)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within     File.fnmatch functions. (CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server     that uses DigestAuth to the Internet or a untrusted network. (CVE-2019-16201)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to     insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this     issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not     address an isolated CR or an isolated LF. (CVE-2019-16254)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first     argument (aka the command argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby method. (CVE-2019-16255)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1420 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1426 advisory.

  - The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to     cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a     crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as     demonstrated by conducting a SQL injection attack against Ruby on Rails, aka Unsafe Object Creation     Vulnerability. (CVE-2013-0269)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1423 advisory.

  - The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to     cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a     crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as     demonstrated by conducting a SQL injection attack against Ruby on Rails, aka Unsafe Object Creation     Vulnerability. (CVE-2013-0269)

  - The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through     2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not     rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead     to creation of a malicious object within the interpreter, with adverse effects that are application-     dependent. (CVE-2020-10663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1417 advisory.

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
    (CVE-2020-15586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1419 advisory.

  - In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a     data upload is being performed. This license can be used to upload data to a central Lynis server.
    Although no data can be extracted by knowing the license key, it may be possible to upload the data of     additional scans. (CVE-2019-13033)

  - CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to     check the log and report file permissions was not working as intended and could be bypassed locally.
    Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the     point where the specific routine is doing its check. After that, the file can be removed, recreated, and     used for additional attacks. (CVE-2020-13882)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1421 advisory.

  - Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably     have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-     RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive     memory allocation). (CVE-2020-13757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1429 advisory.

  - In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse     a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead     applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded     HTTP headers or other potentially dangerous substrings. (CVE-2016-10739)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
    (This is not exploitable when glibc has CVE-2016-10739 fixed.) (CVE-2019-18348)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. (CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    (CVE-2019-9947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1424 advisory.

  - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share. (CVE-2019-10197)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1428 advisory.

  - In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse     a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead     applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded     HTTP headers or other potentially dangerous substrings. (CVE-2016-10739)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
    (This is not exploitable when glibc has CVE-2016-10739 fixed.) (CVE-2019-18348)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. (CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    (CVE-2019-9947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1418 advisory.

  - Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE (CVE-2020-11984)

  - Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on     certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent     use of memory pools. Configuring the LogLevel of mod_http2 above info will mitigate this vulnerability     for unpatched servers. (CVE-2020-11993)

  - Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a     HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource     afterwards. Configuring the HTTP/2 feature via H2Push off will mitigate this vulnerability for unpatched     servers. (CVE-2020-9490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1427 advisory.

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1475 advisory.

  - It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker     could abuse this flaw to get confidential information by tricking the user into connecting to a fake     server without the user noticing the difference. (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1481 advisory.

  - Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. (CVE-2018-21009)

  - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function     PSOutputDev::checkPageSlice at PSOutputDev.cc. (CVE-2019-10871)

  - In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc     via data with inconsistent heights or widths. (CVE-2019-12293)

  - The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream     length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the     heap, with a size controlled by an attacker, as demonstrated by pdftocairo. (CVE-2019-9959)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1476 advisory.

  - GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a     specially crafted email that contains a valid signature from the entity to be impersonated as an     attachment. (CVE-2018-15587)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1480 advisory.

  - The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within     libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-     handling code. (CVE-2017-18232)

  - The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8     does not validate certain resource availability, which allows local users to cause a denial of service     (NULL pointer dereference). (CVE-2018-8043)

  - A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
    (CVE-2019-18808)

  - A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     kfifo_alloc() failures, aka CID-a7b2df76b42b. (CVE-2019-19054)

  - A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka     CID-9c0530e898f3. (CVE-2019-19061)

  - Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow     attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout()     failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the     htc_connect_service() function, aka CID-853acf7caf10. (CVE-2019-19073)

  - A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
    (CVE-2019-19074)

  - In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory     locations from another process in the same guest. This problem is limit to the host running linux kernel     4.10 with a guest running linux kernel 4.16 or later. The problem mainly affects AMD processors but Intel     CPUs cannot be ruled out. (CVE-2019-3016)

  - In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check.
    This could lead to local information disclosure with system execution privileges needed. User interaction     is not needed for exploitation. (CVE-2019-9445)

  - An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10.
    Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767. (CVE-2020-12655)

  - In the Linux kernel through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka     CID-28ebeb8db770. (CVE-2020-15393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1479 advisory.

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by     the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
    (CVE-2020-15586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1477 advisory.

  - An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-     catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
    (CVE-2018-18751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1478 advisory.

  - It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all     contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard     shortcuts, and potentially other actions. (CVE-2019-3820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1474 advisory.

  - The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in     GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to     uninitialized memory use when processing certain TIFF image files. (CVE-2019-11459)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1473 advisory.

  - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client     certificates. A remote attacker in possession of a valid certificate with an empty username field could     possibly use this issue to impersonate other users. (CVE-2019-3814)

  - In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the     indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the     fts and pop3-uidl components. (CVE-2019-7524)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
(CVE-2018-16396)

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269 , but does not rely on poor garbage-collection behavior within Ruby.
Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent. (CVE-2020-10663)

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the application. (CVE-2018-14404)

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A use-after-free flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked against libxml2 to crash when parsing a specially crafted XML file. (CVE-2017-15412)

The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data. A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.
(CVE-2015-8035)

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251 . (CVE-2018-14567)

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
(CVE-2017-18258)

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. (CVE-2016-5131)

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.
(CVE-2018-19044 )

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
(CVE-2020-13757)

A flaw was found in the default configuration of dnsmasq, as shipped with Fedora and Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled.
Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems. (CVE-2020-14312)

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260 (GHSA-qm7j-c969-7j4q).
The fix for that bug still left the door open for an exploit where
_some_ credential is leaked (but the attacker cannot control which one). Git uses external 'credential helper' programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a 'blank' pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's 'store' helper - Git's 'cache' helper - the 'osxkeychain' helper that ships in Git's 'contrib' directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability. (CVE-2020-11008)

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external 'credential helper' programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
(CVE-2020-5260)

Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection. (CVE-2016-10245)

This issue only affects the 'curl' command line utility. Additionally, this is only an issue when using the '-J' (with the '-O' option) and '-i' command line options combined. In most cases, there is nothing to gain for a local attacker here: the curl command line utility is likely running with the same privileges as the user, and thus the user can already overwrite all the files curl could overwrite. However, a local user will have to call curl with the '-J' and '-i' command line options while requesting content from a malicious server, which then opens up an opportunity for the malicious server to overwrite local files. (CVE-2020-8177)

This security issue is quite hard to abuse, requiring a fairly precise timing attack combined with guessing a just assigned peer-id reference. If successful, only a single client just initiating a new connection will experience a denial of service situation.(CVE-2020-11810)

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. (CVE-2020-13935)

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. (CVE-2020-13934)

tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. (CVE-2019-9824)

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC.
This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
(CVE-2020-7039)

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
(CVE-2020-8608)

ID	Name	Severity
141106	Amazon Linux 2 : kernel (ALAS-2020-1495)	High
140636	Amazon Linux 2 : dovecot (ALAS-2020-1489)	Medium
140635	Amazon Linux 2 : mod_http2 (ALAS-2020-1493)	Medium
140634	Amazon Linux 2 : lua53 (ALAS-2020-1492)	Medium
140612	Amazon Linux AMI : clamav (ALAS-2020-1433)	Low
140611	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1434)	Medium
140210	Amazon Linux AMI : kernel (ALAS-2020-1430)	High
140209	Amazon Linux 2 : kernel (ALAS-2020-1488)	High
140207	Amazon Linux AMI : python34 (ALAS-2020-1432)	Medium
140206	Amazon Linux AMI : chrony (ALAS-2020-1431)	Low
140199	Amazon Linux 2 : squid (ALAS-2020-1486)	High
140198	Amazon Linux 2 : python (ALAS-2020-1483)	Medium
140197	Amazon Linux 2 : ivshmem-tools (ALAS-2020-1485)	Low
140196	Amazon Linux 2 : thunderbird (ALAS-2020-1487)	High
140195	Amazon Linux 2 : python3 (ALAS-2020-1484)	Medium
140194	Amazon Linux 2 : postgresql-jdbc (ALAS-2020-1482)	Medium
140096	Amazon Linux AMI : ruby24 (ALAS-2020-1422)	High
140095	Amazon Linux AMI : python26-httplib2 (ALAS-2020-1420)	Medium
140094	Amazon Linux AMI : ruby19 (ALAS-2020-1426)	High
140093	Amazon Linux AMI : rubygem-json-debuginfo (ALAS-2020-1423)	High
140092	Amazon Linux AMI : golang (ALAS-2020-1417)	Medium
140091	Amazon Linux AMI : lynis (ALAS-2020-1419)	Low
140090	Amazon Linux AMI : python26-rsa (ALAS-2020-1421)	Medium
140089	Amazon Linux AMI : python34 (ALAS-2020-1429)	Medium
140088	Amazon Linux AMI : ctdb (ALAS-2020-1424)	Medium
140087	Amazon Linux AMI : python36 (ALAS-2020-1428)	Medium
140086	Amazon Linux AMI : httpd24 (ALAS-2020-1418)	High
140085	Amazon Linux AMI : python27 (ALAS-2020-1427)	Medium
139862	Amazon Linux 2 : evolution-data-server (ALAS-2020-1475)	Medium
139861	Amazon Linux 2 : poppler (ALAS-2020-1481)	Medium
139859	Amazon Linux 2 : evolution (ALAS-2020-1476)	Medium
139858	Amazon Linux 2 : kernel (ALAS-2020-1480)	Low
139857	Amazon Linux 2 : golang (ALAS-2020-1479)	Medium
139856	Amazon Linux 2 : emacs-gettext (ALAS-2020-1477)	High
139855	Amazon Linux 2 : gnome-shell (ALAS-2020-1478)	Medium
139853	Amazon Linux 2 : evince (ALAS-2020-1474)	Medium
139852	Amazon Linux 2 : dovecot (ALAS-2020-1473)	High
139550	Amazon Linux AMI : ruby20 (ALAS-2020-1416)	Medium
139549	Amazon Linux AMI : libxml2 (ALAS-2020-1415)	Medium
139548	Amazon Linux AMI : keepalived (ALAS-2020-1414)	Low
139339	Amazon Linux 2 : python / python3 (ALAS-2020-1471)	High
139338	Amazon Linux 2 : python-rsa (ALAS-2020-1470)	Medium
139337	Amazon Linux 2 : dnsmasq (ALAS-2020-1469)	High
139093	Amazon Linux AMI : git (ALAS-2020-1413)	Medium
139092	Amazon Linux AMI : doxygen (ALAS-2020-1412)	Medium
139091	Amazon Linux AMI : curl (ALAS-2020-1411)	High
139090	Amazon Linux AMI : openvpn (ALAS-2020-1410)	Medium
139089	Amazon Linux AMI : tomcat8 (ALAS-2020-1409)	Medium
139088	Amazon Linux AMI : qemu-kvm (ALAS-2020-1408)	Medium
139087	Amazon Linux AMI : python27 / python34, python35, python36 (ALAS-2020-1407)	High

Amazon Linux Local Security Checks Family for Nessus