Fedora
CVEs (5,359)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-7595 | Hig | 0.49 | 7.5 | 0.08 | Jan 21, 2020 | xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. | ||
| CVE-2019-20388 | Hig | 0.49 | 7.5 | 0.04 | Jan 21, 2020 | xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. | ||
| CVE-2019-19886 | Hig | 0.49 | 7.5 | 0.03 | Jan 21, 2020 | Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc. | ||
| CVE-2020-7105 | Hig | 0.49 | 7.5 | 0.03 | Jan 16, 2020 | async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked. | ||
| CVE-2020-7044 | Hig | 0.49 | 7.5 | 0.03 | Jan 16, 2020 | In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one errors. | ||
| CVE-2020-6851 | Hig | 0.49 | 7.5 | 0.05 | Jan 13, 2020 | OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. | ||
| CVE-2019-5188 | Hig | 0.49 | 7.5 | 0.01 | Jan 8, 2020 | A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this… | ||
| CVE-2013-4357 | Hig | 0.49 | 7.5 | 0.03 | Dec 31, 2019 | The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. | ||
| CVE-2012-5645 | Hig | 0.49 | 7.5 | 0.04 | Dec 30, 2019 | A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive CPU consumption. | ||
| CVE-2019-3994 | Hig | 0.49 | 7.5 | 0.03 | Dec 17, 2019 | ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieve_url() to use a freed variable. | ||
| CVE-2019-3992 | Hig | 0.49 | 7.5 | 0.01 | Dec 17, 2019 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames… | ||
| CVE-2019-19583 | Hig | 0.49 | 7.5 | 0.02 | Dec 11, 2019 | An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the… | ||
| CVE-2013-4410 | Hig | 0.49 | 7.5 | 0.02 | Dec 2, 2019 | ReviewBoard: has an access-control problem in REST API | ||
| CVE-2019-6477 | Hig | 0.49 | 7.5 | 0.04 | Nov 26, 2019 | With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been… | ||
| CVE-2019-19270 | Hig | 0.49 | 7.5 | 0.01 | Nov 26, 2019 | An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow… | ||
| CVE-2012-5535 | Hig | 0.49 | 7.5 | 0.02 | Nov 25, 2019 | gnome-system-log polkit policy allows arbitrary files on the system to be read | ||
| CVE-2019-11287 | Hig | 0.49 | 7.5 | 0.05 | Nov 23, 2019 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason"… | ||
| CVE-2012-4524 | Hig | 0.49 | 7.5 | 0.03 | Nov 21, 2019 | xlockmore before 5.43 'dclock' security bypass vulnerability | ||
| CVE-2013-1817 | Hig | 0.49 | 7.5 | 0.03 | Nov 20, 2019 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. | ||
| CVE-2013-1816 | Hig | 0.49 | 7.5 | 0.03 | Nov 20, 2019 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request. |
- risk 0.49cvss 7.5epss 0.08
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
- risk 0.49cvss 7.5epss 0.04
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
- risk 0.49cvss 7.5epss 0.03
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.
- risk 0.49cvss 7.5epss 0.03
async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.
- risk 0.49cvss 7.5epss 0.03
In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one errors.
- risk 0.49cvss 7.5epss 0.05
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
- risk 0.49cvss 7.5epss 0.01
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this…
- risk 0.49cvss 7.5epss 0.03
The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.
- risk 0.49cvss 7.5epss 0.04
A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive CPU consumption.
- risk 0.49cvss 7.5epss 0.03
ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG server by sending multiple HTTP POST requests which causes the ELOG function retrieve_url() to use a freed variable.
- risk 0.49cvss 7.5epss 0.01
ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames…
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the…
- risk 0.49cvss 7.5epss 0.02
ReviewBoard: has an access-control problem in REST API
- risk 0.49cvss 7.5epss 0.04
With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been…
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow…
- risk 0.49cvss 7.5epss 0.02
gnome-system-log polkit policy allows arbitrary files on the system to be read
- risk 0.49cvss 7.5epss 0.05
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason"…
- risk 0.49cvss 7.5epss 0.03
xlockmore before 5.43 'dclock' security bypass vulnerability
- risk 0.49cvss 7.5epss 0.03
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
- risk 0.49cvss 7.5epss 0.03
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
Page 89 of 268