CVE-2019-8756 - Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and ... read CVE-2019-8756
Published: October 27, 2020; 4:15:18 PM -0400

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2019-8759 - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. A local user may be able to cause unexpected system ter... read CVE-2019-8759
Published: October 27, 2020; 4:15:18 PM -0400

V3.1: 7.1 HIGH
V2.0: 6.6 MEDIUM

CVE-2018-4474 - A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.
Published: October 27, 2020; 4:15:14 PM -0400

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2020-26566 - A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
Published: October 26, 2020; 2:15:14 PM -0400

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2015-8743 - QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. It could occur while performing 'ioport' r/w operations. A privileged (CAP_SYS_RAWIO) user/process could use this flaw to leak or co... read CVE-2015-8743
Published: December 29, 2016; 5:59:00 PM -0500

V3.1: 7.1 HIGH
V2.0: 3.6 LOW

CVE-2017-13711 - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
Published: September 01, 2017; 9:29:00 AM -0400

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2017-9524 - The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all in... read CVE-2017-9524
Published: July 06, 2017; 12:29:00 PM -0400

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2020-27605 - BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
Published: October 21, 2020; 11:15:27 AM -0400

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-27606 - BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Published: October 21, 2020; 11:15:27 AM -0400

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2020-27607 - In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus ... read CVE-2020-27607
Published: October 21, 2020; 11:15:27 AM -0400

V3.1: 6.5 MEDIUM
V2.0: 6.4 MEDIUM

CVE-2020-27603 - BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.
Published: October 21, 2020; 11:15:26 AM -0400

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2020-25820 - BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
Published: October 21, 2020; 9:15:12 AM -0400

V3.1: 6.5 MEDIUM
V2.0: 4.0 MEDIUM

CVE-2020-27608 - In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
Published: October 21, 2020; 11:15:27 AM -0400

V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-27609 - BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant.
Published: October 21, 2020; 11:15:27 AM -0400

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2019-8737 - A denial of service issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. An attacker in a privileged position may be able to perf... read CVE-2019-8737
Published: October 27, 2020; 4:15:18 PM -0400

V3.1: 6.5 MEDIUM
V2.0: 4.0 MEDIUM

CVE-2019-8736 - An input validation issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. An attacker in a privileged network position may b... read CVE-2019-8736
Published: October 27, 2020; 4:15:18 PM -0400

V3.1: 6.5 MEDIUM
V2.0: 4.0 MEDIUM

CVE-2019-8734 - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, Safari 13, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously craf... read CVE-2019-8734
Published: October 27, 2020; 4:15:18 PM -0400

V3.1: 8.8 HIGH
V2.0: 6.8 MEDIUM

CVE-2019-8716 - A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006. An application may be able to execute arbitrary code with system privileges.
Published: October 27, 2020; 4:15:17 PM -0400

V3.1: 9.8 CRITICAL
V2.0: 10.0 HIGH

CVE-2019-8668 - A denial of service issue was addressed with improved validation. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. Processing a maliciously crafted image may lead to a denial of service.
Published: October 27, 2020; 4:15:17 PM -0400

V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2019-8675 - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to ex... read CVE-2019-8675
Published: October 27, 2020; 4:15:17 PM -0400

V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM