CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–2 of 2 advisories (Page 1/1)

CVE-2020-1487110.0/CRITICALEPSS 80.2%CISA KEV

2020-10-21

Oracle Solaris PAM (Pluggable Authentication Module) Stack-Based Buffer Overflow Remote Code Execution (CVE-2020-14871)

[Affected Scope] Oracle Solaris 10 and Solaris 11 (prior to version 11.1)

[Impact] Unauthenticated remote attackers can exploit this vulnerability over the network to gain full root privileges and take over the system

[Mitigation] Apply the official vendor patches immediately, or disable Keyboard-Interactive authentication and PAM usage in the SSH configuration

CVE-2019-30108.8/HIGHEPSS 13.5%CISA KEV

2019-10-16

[Affected Scope] Oracle Solaris 11 operating system environments running the XScreenSaver component.

[Impact] A low-privileged local attacker can exploit this vulnerability to escalate privileges to root, leading to a complete takeover of the system.

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or temporarily remove the setuid bit from the xscreensaver binary.