Fedoraproject
Page 14 of 55 — Fedoraproject CVEs from a corpus of 5439, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0670 | Critical | 9.1 | 2022-07-25 | A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vul… |
CVE-2020-7677 | High | 8.6 | 2022-07-25 | This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provi… |
CVE-2021-46829 | High | 7.8 | 2022-07-24 | GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-… |
CVE-2022-31160 | Medium | 6.1 | 2022-07-20 | jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulner… |
CVE-2022-21549 | Medium | 5.3 | 2022-07-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21541 | Medium | 5.9 | 2022-07-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are… |
CVE-2022-21540 | Medium | 5.3 | 2022-07-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are… |
CVE-2022-21537 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vu… |
CVE-2022-21534 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Eas… |
CVE-2022-21531 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21530 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21529 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21528 | Medium | 5.5 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21527 | Medium | 5.5 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21526 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21525 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-21522 | Medium | 4.4 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Dif… |
CVE-2022-21517 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vu… |
CVE-2022-21515 | Medium | 4.9 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 an… |
CVE-2022-21509 | Medium | 5.5 | 2022-07-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exp… |
CVE-2022-2476 | Medium | 5.5 | 2022-07-19 | A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ========================================… |
CVE-2022-34169 | High | 7.5 | 2022-07-19 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java cl… |
CVE-2022-32323 | High | 7.3 | 2022-07-14 | AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. |
CVE-2022-23825 | Medium | 6.5 | 2022-07-14 | Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. |
CVE-2022-32215 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead… |
CVE-2022-32213 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead… |
CVE-2022-32212 | High | 8.1 | 2022-07-14 | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypas… |
CVE-2022-29187 | High | 7.8 | 2022-07-12 | Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privil… |
CVE-2022-29901 | Medium | 5.6 | 2022-07-12 | Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary… |
CVE-2022-29900 | Medium | 6.5 | 2022-07-12 | Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. |
CVE-2022-2345 | High | 7.8 | 2022-07-08 | Use After Free in GitHub repository vim/vim prior to 9.0.0046. |
CVE-2022-2344 | High | 7.8 | 2022-07-08 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. |
CVE-2022-2343 | High | 7.8 | 2022-07-08 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. |
CVE-2022-32208 | Medium | 5.9 | 2022-07-07 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle at… |
CVE-2022-32207 | Critical | 9.8 | 2022-07-07 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporar… |
CVE-2022-32206 | Medium | 6.5 | 2022-07-07 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different alg… |
CVE-2022-32205 | Medium | 4.3 | 2022-07-07 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large a… |
CVE-2022-31129 | High | 7.5 | 2022-07-06 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient p… |
CVE-2021-3695 | Medium | 4.5 | 2022-07-06 | A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption o… |
CVE-2022-31117 | Medium | 5.9 | 2022-07-05 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating… |
CVE-2022-31116 | High | 7.5 | 2022-07-05 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain charact… |
CVE-2022-33742 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33741 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33740 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-2304 | High | 7.8 | 2022-07-05 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-26365 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-2097 | Medium | 5.3 | 2022-07-05 | AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. Th… |
CVE-2022-2309 | High | 7.5 | 2022-07-05 | NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10… |
CVE-2022-2289 | High | 7.8 | 2022-07-03 | Use After Free in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2288 | High | 7.8 | 2022-07-03 | Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2287 | High | 7.1 | 2022-07-02 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-34912 | Medium | 6.1 | 2022-07-02 | An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title with… |
CVE-2022-34911 | Medium | 6.1 | 2022-07-02 | An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a Jav… |
CVE-2022-2286 | High | 7.8 | 2022-07-02 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2285 | High | 7.8 | 2022-07-02 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2284 | High | 7.8 | 2022-07-02 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-34903 | Medium | 6.5 | 2022-07-01 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of G… |
CVE-2022-32325 | Medium | 6.5 | 2022-07-01 | JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c. |
CVE-2022-32091 | High | 7.5 | 2022-07-01 | MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. |
CVE-2022-32089 | High | 7.5 | 2022-07-01 | MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level. |
CVE-2022-32084 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. |
CVE-2022-32082 | High | 7.5 | 2022-07-01 | MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. |
CVE-2022-32081 | High | 7.5 | 2022-07-01 | MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. |
CVE-2022-33099 | High | 7.5 | 2022-07-01 | An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. |
CVE-2022-2264 | High | 7.8 | 2022-07-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2257 | High | 7.8 | 2022-06-30 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2058 | Medium | 5.5 | 2022-06-30 | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-2057 | Medium | 5.5 | 2022-06-30 | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-2056 | Medium | 5.5 | 2022-06-30 | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-2231 | Medium | 5.5 | 2022-06-28 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. |
CVE-2022-31052 | Medium | 6.5 | 2022-06-28 | Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the av… |
CVE-2022-2210 | High | 7.8 | 2022-06-27 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2208 | Medium | 5.5 | 2022-06-27 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. |
CVE-2022-2207 | High | 7.8 | 2022-06-27 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2206 | High | 7.8 | 2022-06-26 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-32209 | Medium | 6.1 | 2022-06-24 | # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerab… |
CVE-2022-2183 | High | 7.8 | 2022-06-23 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2182 | High | 7.8 | 2022-06-23 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-33070 | Medium | 5.5 | 2022-06-23 | Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability… |
CVE-2022-33068 | Medium | 5.5 | 2022-06-23 | An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. |
CVE-2022-29526 | Medium | 5.3 | 2022-06-23 | Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorr… |
CVE-2022-2175 | High | 7.8 | 2022-06-23 | Buffer Over-read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2068 | High | 7.3 | 2022-06-21 | In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise she… |
CVE-2022-1720 | High | 7.8 | 2022-06-20 | Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modi… |
CVE-2022-2129 | High | 7.8 | 2022-06-19 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2126 | High | 7.8 | 2022-06-19 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2125 | High | 7.8 | 2022-06-19 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2124 | High | 7.8 | 2022-06-19 | Buffer Over-read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-32547 | High | 7.8 | 2022-06-16 | In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at… |
CVE-2022-32546 | High | 7.8 | 2022-06-16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrust… |
CVE-2022-32545 | High | 7.8 | 2022-06-16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrust… |
CVE-2022-2085 | Medium | 5.5 | 2022-06-16 | A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buf… |
CVE-2022-30184 | Medium | 5.5 | 2022-06-15 | .NET and Visual Studio Information Disclosure Vulnerability |
CVE-2022-21166 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2022-21125 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure… |
CVE-2022-21123 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via l… |
CVE-2022-31033 | Medium | 5.9 | 2022-06-09 | The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow lin… |
CVE-2022-31813 | Critical | 9.8 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism… |
CVE-2022-30556 | High | 7.5 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. |
CVE-2022-30522 | High | 7.5 | 2022-06-09 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excess… |