cve.bz

fedoraproject fedora vulnerabilities, newest first, page 27

Filter
  1. 6.1CVE-2022-31160EPSS 2.7%

    jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input en…

  2. 5.3CVE-2022-21549EPSS 2.5%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.…

  3. 5.9CVE-2022-21541EPSS 2.9%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Ent…

  4. 5.3CVE-2022-21540EPSS 4.2%

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Ent…

  5. 4.9CVE-2022-21537EPSS 1.8%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple pro…

  6. 4.9CVE-2022-21534EPSS 1.7%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network acces…

  7. 4.9CVE-2022-21531EPSS 1.7%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  8. 4.9CVE-2022-21530EPSS 1.8%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  9. 4.9CVE-2022-21529EPSS 1.7%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  10. 5.5CVE-2022-21528EPSS 1.6%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  11. 5.5CVE-2022-21527EPSS 1.7%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  12. 4.9CVE-2022-21526EPSS 1.9%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  13. 4.9CVE-2022-21525EPSS 1.8%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  14. 4.4CVE-2022-21522EPSS 1.7%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with network acc…

  15. 4.9CVE-2022-21517EPSS 1.8%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple pro…

  16. 4.9CVE-2022-21515EPSS 1.8%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with n…

  17. 5.5CVE-2022-21509EPSS 1.7%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via m…

  18. 5.5CVE-2022-2476EPSS 0.4%

    A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================================================================84257==ERROR: AddressSanitizer: SEGV on unknown addre…

  19. 7.5CVE-2022-34169EPSS 82%

    The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java by…

  20. 7.3CVE-2022-32323EPSS 0.9%

    AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.

  21. 6.5CVE-2022-32215EPSS 70%

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

  22. 6.5CVE-2022-32213EPSS 45%

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

  23. 8.1CVE-2022-32212EPSS 6.4%

    A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid befo…

  24. 7.8CVE-2022-29187EPSS 0.4%

    Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by…

  25. 6.5CVE-2022-29901EPSS 5.0%

    Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions …

  26. 7.8CVE-2022-2345EPSS 1.3%

    Use After Free in GitHub repository vim/vim prior to 9.0.0046.

  27. 7.8CVE-2022-2344EPSS 1.3%

    Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.

  28. 7.8CVE-2022-2343EPSS 1.4%

    Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

  29. 5.9CVE-2022-32208EPSS 8.4%

    When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

  30. 9.8CVE-2022-32207EPSS 12%

    When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accident…

  31. 6.5CVE-2022-32206EPSS 36%

    curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbo…

  32. 4.3CVE-2022-32205EPSS 31%

    A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers t…

  33. 7.5CVE-2022-31129EPSS 5.6%

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more spec…

  34. 4.5CVE-2021-3695EPSS 0.5%

    A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. Th…

  35. 5.9CVE-2022-31117EPSS 1.9%

    UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating a buffer for string decoding can cause the buffer to get freed twice. Due to how…

  36. 7.5CVE-2022-31116EPSS 2.5%

    UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain characters. JSON strings that contain escaped surrogate characters not part of a proper…

  37. 7.1CVE-2022-33742EPSS 0.3%

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions befo…

  38. 7.1CVE-2022-33741EPSS 0.3%

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions befo…

  39. 7.1CVE-2022-33740EPSS 0.3%

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions befo…

  40. 7.8CVE-2022-2304EPSS 1.5%

    Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

  41. 7.1CVE-2022-26365EPSS 0.3%

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions befo…

  42. 5.3CVE-2022-2097EPSS 4.9%

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wa…

  43. 7.5CVE-2022-2309EPSS 2.4%

    NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggerin…

  44. 7.8CVE-2022-2289EPSS 1.3%

    Use After Free in GitHub repository vim/vim prior to 9.0.

  45. 7.8CVE-2022-2288EPSS 1.4%

    Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.

  46. 7.1CVE-2022-2287EPSS 1.4%

    Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

  47. 6.1CVE-2022-34912EPSS 1.1%

    An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HT…

  48. 6.1CVE-2022-34911EPSS 1.1%

    An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page tit…

  49. 7.8CVE-2022-2286EPSS 1.4%

    Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.

  50. 7.8CVE-2022-2285EPSS 1.4%

    Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.