Oracle GraalVM 20.1.0 Enterprise Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:*
part: a version: 20.1.0 update: *
| Vendor | Oracle (3509f9eb-d8a0-57da-b153-b8021021b133) |
|---|---|
| Product | Graalvm (d6f64539-949c-52de-a9c5-1fd03b36e27e) |
| Edition | * |
| Language | * |
| Software edition | enterprise |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/oracle/graal |
purl2cpe | 2026-06-01 10:18:14.841634 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-8172 |
vulnerable | 2026-06-08 05:27:15.071289 |
Details available
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
Published: 2020-06-08T13:08:16.000Z
Updated: 2024-08-04T09:56:26.895Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-14718 |
vulnerable | 2026-06-08 05:19:24.446371 |
Details available
HIGH (7.2)
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: JVMCI). Supported versions that are affected are 19.3.2 and 20.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2020-07-15T17:34:35.000Z
Updated: 2024-09-26T20:36:54.168Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11080 |
vulnerable | 2026-06-08 05:16:36.420528 |
Denial of service in nghttp2
LOW (3.7)
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
Published: 2020-06-03T00:00:00.000Z
Updated: 2025-06-09T15:45:50.711Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17561 |
vulnerable | 2026-06-08 05:13:10.673857 |
Details available
The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Published: 2020-03-30T18:44:42.000Z
Updated: 2024-08-05T01:40:15.924Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17560 |
vulnerable | 2026-06-08 05:13:10.673384 |
Details available
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
Published: 2020-03-30T18:39:41.000Z
Updated: 2024-08-05T01:40:15.835Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.