Fedora

CVEs (5,359)

• CVE-2021-37975HigKEVOct 8, 2021
  Google

  Chrome
  risk 0.72cvss 8.8epss 0.35

  Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• CVE-2020-13671HigKEVNov 20, 2020
  Drupal

  Drupal
  risk 0.72cvss 8.8epss 0.35

  Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0…

• CVE-2020-8518CriFeb 17, 2020
  Horde (software)

  Groupware
  risk 0.72cvss 9.8epss 0.72

  Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.

• CVE-2014-0160HigKEVApr 7, 2014
  OpenSSL Project

  OpenSSL
  risk 0.72cvss 7.5epss 1.00

  The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by…

• CVE-2023-39361CriSep 5, 2023
  Cacti (software)

  Cacti
  risk 0.71cvss 9.8epss 0.89

  Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an…

• CVE-2022-3038HigKEVSep 26, 2022
  Google

  Chrome
  risk 0.71cvss 8.8epss 0.25

  Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• CVE-2021-3781CriFeb 16, 2022
  Artifex

  Ghostscript
  risk 0.71cvss 9.9epss 0.84

  A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript…

• CVE-2021-39144HigKEVAug 23, 2021
  Xstream

  Xstream
  risk 0.71cvss 8.5epss 0.98

  XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed…

• CVE-2021-21166HigKEVMar 9, 2021
  Google

  Chrome
  risk 0.71cvss 8.8epss 0.24

  Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• CVE-2021-21148HigKEVFeb 9, 2021
  Google

  Chrome
  risk 0.71cvss 8.8epss 0.20

  Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• CVE-2020-15999CriKEVNov 3, 2020
  FreeType

  Freetype
  risk 0.71cvss 9.6epss 0.64

  Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• CVE-2020-11984CriAug 7, 2020
  Apache

  HTTP Server
  risk 0.71cvss 9.8epss 0.90

  Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

• CVE-2019-0211HigKEVApr 8, 2019
  Apache

  HTTP Server
  risk 0.71cvss 7.8epss 0.65

  In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent…

• CVE-2024-4761HigKEVMay 14, 2024
  Google

  Chrome
  risk 0.70cvss 8.8epss 0.11

  Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

• CVE-2024-0519HigKEVJan 16, 2024
  Google

  Chrome
  risk 0.70cvss 8.8epss 0.04

  Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• CVE-2023-7024HigKEVDec 21, 2023
  Google

  Chrome
  risk 0.70cvss 8.8epss 0.07

  Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• CVE-2023-42917HigKEVNov 30, 2023
  Apple Inc.

  macOS
  risk 0.70cvss 8.8epss 0.09

  A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been…

• CVE-2023-4863HigKEVSep 12, 2023
  Google

  Chrome
  risk 0.70cvss 8.8epss 1.00

  Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

• CVE-2022-32893HigKEVAug 24, 2022
  Apple Inc.

  macOS
  risk 0.70cvss 8.8epss 0.10

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that…

• CVE-2021-30858HigKEVAug 24, 2021
  Apple Inc.

  macOS
  risk 0.70cvss 8.8epss 0.13

  A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been…