fedora vulnerabilities and exploits

(subscribe to this query)

7.2

CVSSv2

The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration....

4.3

CVSSv2

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temporary denial of service, posing a low risk to application availability....

Libpng Pngcheck 2.4.0 Fedoraproject Fedora Extra Packages For Enterprise Linux 7.0 Fedoraproject Fedora Extra Packages For Enterprise Linux 8.0 Fedoraproject Fedora 31 Fedoraproject Fedora 32 Fedoraproject Fedora 33 Fedoraproject Fedora 34

10

CVSSv2

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process...

Pyyaml Pyyaml Fedoraproject Fedora 30 Fedoraproject Fedora 31 Fedoraproject Fedora 32 Fedoraproject Fedora 33 Opensuse Leap 15.1

5

CVSSv2

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape....

Palletsprojects Jinja Fedoraproject Fedora 28 Fedoraproject Fedora 29 Fedoraproject Fedora 30

5

CVSSv2

Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough...

Moodle Moodle Fedoraproject Fedora 15 Fedoraproject Fedora 16 Fedoraproject Fedora 17

5

CVSSv2

Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent....

Mindrot Jbcrypt Fedoraproject Fedora 20 Fedoraproject Fedora 21 Fedoraproject Fedora 22

6.4

CVSSv2

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data....

Php Php Fedoraproject Fedora 31 Fedoraproject Fedora 32 Fedoraproject Fedora 33

7.5

CVSSv2

HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods...

Wisc Htcondor Fedoraproject Fedora 30 Fedoraproject Fedora 31 Fedoraproject Fedora 32

5

CVSSv2

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token....

Mediawiki Mediawiki Fedoraproject Fedora 21 Fedoraproject Fedora 22 Fedoraproject Fedora 23

4.3

CVSSv2

Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi....

Ikiwiki Ikiwiki Fedoraproject Fedora 20 Fedoraproject Fedora 21 Fedoraproject Fedora 22

1 2 3 4 5 6 NEXT »