Fedora
CVEs (5,359)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-26495 | Cri | 0.64 | 9.8 | 0.03 | Mar 6, 2022 | In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists… | ||
| CVE-2022-0730 | Cri | 0.64 | 9.8 | 0.04 | Mar 3, 2022 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. | ||
| CVE-2021-3657 | Cri | 0.64 | 9.8 | 0.03 | Feb 18, 2022 | A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could… | ||
| CVE-2021-3773 | Cri | 0.64 | 9.8 | 0.05 | Feb 16, 2022 | A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks. | ||
| CVE-2022-23304 | Cri | 0.64 | 9.8 | 0.02 | Jan 17, 2022 | The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495. | ||
| CVE-2022-23303 | Cri | 0.64 | 9.8 | 0.03 | Jan 17, 2022 | The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494. | ||
| CVE-2021-44143 | Cri | 0.64 | 9.8 | 0.04 | Nov 22, 2021 | A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be… | ||
| CVE-2021-40391 | Cri | 0.64 | 9.8 | 0.03 | Nov 19, 2021 | An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a… | ||
| CVE-2021-27023 | Cri | 0.64 | 9.8 | 0.01 | Nov 18, 2021 | A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007 | ||
| CVE-2021-42377 | Cri | 0.64 | 9.8 | 0.04 | Nov 15, 2021 | An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered… | ||
| CVE-2021-35368 | Cri | 0.64 | 9.8 | 0.03 | Nov 5, 2021 | OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname. | ||
| CVE-2021-31556 | Cri | 0.64 | 9.8 | 0.02 | Aug 12, 2021 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob. | ||
| CVE-2021-20314 | Cri | 0.64 | 9.8 | 0.03 | Aug 12, 2021 | Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages. | ||
| CVE-2021-32810 | Cri | 0.64 | 9.8 | 0.02 | Aug 2, 2021 | crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are… | ||
| CVE-2021-22915 | Cri | 0.64 | 9.8 | 0.02 | Jun 11, 2021 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection. | ||
| CVE-2021-30475 | Cri | 0.64 | 9.8 | 0.02 | Jun 4, 2021 | aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. | ||
| CVE-2021-33574 | Cri | 0.64 | 9.8 | 0.03 | May 25, 2021 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service… | ||
| CVE-2021-30473 | Cri | 0.64 | 9.8 | 0.02 | May 6, 2021 | aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap. | ||
| CVE-2021-20204 | Cri | 0.64 | 9.8 | 0.02 | May 6, 2021 | A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This… | ||
| CVE-2021-20307 | Cri | 0.64 | 9.8 | 0.02 | Apr 5, 2021 | Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values. |
- risk 0.64cvss 9.8epss 0.03
In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will cause a zero-sized buffer to be allocated for the name, resulting in a write to a dangling pointer. This issue exists…
- risk 0.64cvss 9.8epss 0.04
Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.
- risk 0.64cvss 9.8epss 0.03
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could…
- risk 0.64cvss 9.8epss 0.05
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.
- risk 0.64cvss 9.8epss 0.02
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
- risk 0.64cvss 9.8epss 0.03
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
- risk 0.64cvss 9.8epss 0.04
A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be…
- risk 0.64cvss 9.8epss 0.03
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a…
- risk 0.64cvss 9.8epss 0.01
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
- risk 0.64cvss 9.8epss 0.04
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered…
- risk 0.64cvss 9.8epss 0.03
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob.
- risk 0.64cvss 9.8epss 0.03
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- risk 0.64cvss 9.8epss 0.02
crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are…
- risk 0.64cvss 9.8epss 0.02
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.
- risk 0.64cvss 9.8epss 0.02
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
- risk 0.64cvss 9.8epss 0.03
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service…
- risk 0.64cvss 9.8epss 0.02
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
- risk 0.64cvss 9.8epss 0.02
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This…
- risk 0.64cvss 9.8epss 0.02
Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory values.
Page 8 of 268