[ Vendor · 20 CVEs ]
Fedoraproject
CVEs affecting Fedoraproject published in the last 30 days, plus any Fedoraproject CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2024-4671 | 14 May 2024 | CVSS 9.6 | Google Chromium Visuals Use-After-FreeUse after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially… | Exploited |
| CVE-2023-7101 | 24 Dec 2023 | CVSS 7.8 | Spreadsheet::ParseExcel Remote Code ExecutionSpreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code… | ExploitedFix |
| CVE-2023-41993 | 21 Sep 2023 | CVSS 8.8 | Apple Multiple Products WebKit Code ExecutionThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution… | Exploited |
| CVE-2023-4762 | 5 Sep 2023 | CVSS 8.8 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium… | ExploitedFix |
| CVE-2022-2856 | 26 Sep 2022 | CVSS 6.5 | Google Chromium Intents Insufficient Input ValidationInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily… | ExploitedFix |
| CVE-2022-3038 | 26 Sep 2022 | CVSS 8.8 | Google Chromium Network Service Use-After-FreeUse after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2021-44026 | 19 Nov 2021 | CVSS 9.8 | Roundcube Webmail SQL InjectionRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. | ExploitedFix |
| CVE-2021-3156 | 26 Jan 2021 | CVSS 7.8 | Sudo Heap-Based Buffer OverflowSudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via… | ExploitedFix |
| CVE-2020-36193 | 18 Jan 2021 | CVSS 7.5 | PEAR Archive_Tar Improper Link ResolutionTar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue… | ExploitedFix |
| CVE-2020-35730 | 28 Dec 2020 | CVSS 6.1 | Roundcube Webmail Cross-Site Scripting (XSS)An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text… | ExploitedFix |
| CVE-2020-28949 | 19 Nov 2020 | CVSS 7.8 | PEAR Archive_Tar Deserialization of Untrusted DataArchive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to… | Exploited |
| CVE-2020-16846 | 6 Nov 2020 | CVSS 9.8 | SaltStack Salt Shell InjectionAn issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in… | Exploited |
| CVE-2020-7247 | 29 Jan 2020 | CVSS 9.8 | OpenSMTPD Remote Code Executionsmtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as… | ExploitedFix |
| CVE-2019-16928 | 27 Sep 2019 | CVSS 9.8 | Exim Out-of-bounds WriteExim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in… | ExploitedFix |
| CVE-2019-13272 | 17 Jul 2019 | CVSS 7.8 | Linux Kernel Improper Privilege ManagementIn the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a… | ExploitedFix |
| CVE-2016-5195 | 10 Nov 2016 | CVSS 7.0 | Linux Kernel Race ConditionRace condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of… | ExploitedFix |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-3306 | 18 May 2015 | CVSS 10.0 | ProFTPD mod_copy lets anyone copy files on the serverThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Exploited |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |