Vulnerabilities > Debian > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-09-25 CVE-2020-25625 Infinite Loop vulnerability in multiple products
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
local
high complexity
qemu debian CWE-835
5.3
2020-09-25 CVE-2020-25085 Out-of-bounds Write vulnerability in multiple products
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
local
high complexity
qemu debian CWE-787
5.0
2020-09-24 CVE-2020-26088 Incorrect Default Permissions vulnerability in multiple products
A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.
local
low complexity
linux debian opensuse canonical CWE-276
5.5
2020-09-23 CVE-2020-25604 Race Condition vulnerability in multiple products
An issue was discovered in Xen through 4.14.x.
local
high complexity
xen fedoraproject debian opensuse CWE-362
4.7
2020-09-23 CVE-2020-25602 Improper Handling of Exceptional Conditions vulnerability in multiple products
An issue was discovered in Xen through 4.14.x.
local
low complexity
xen fedoraproject debian opensuse CWE-755
6.0
2020-09-23 CVE-2020-25601 An issue was discovered in Xen through 4.14.x.
local
low complexity
xen debian fedoraproject opensuse
5.5
2020-09-23 CVE-2020-25600 Out-of-bounds Write vulnerability in multiple products
An issue was discovered in Xen through 4.14.x.
local
low complexity
xen fedoraproject opensuse debian CWE-787
5.5
2020-09-23 CVE-2020-25596 Injection vulnerability in multiple products
An issue was discovered in Xen through 4.14.x.
local
low complexity
xen fedoraproject debian opensuse CWE-74
5.5
2020-09-23 CVE-2020-25739 Cross-site Scripting vulnerability in multiple products
An issue was discovered in the gon gem before gon-6.4.0 for Ruby.
network
low complexity
gon-project debian canonical CWE-79
6.1
2020-09-21 CVE-2020-6571 Improper Input Validation vulnerability in multiple products
Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
network
low complexity
google opensuse fedoraproject debian CWE-20
4.3