Fedoraproject: >> Fedora >> 20 Security Vulnerabilities
Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.
CVSS Score
6.2
EPSS Score
0.001
Published
2022-09-29
A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.
CVSS Score
5.9
EPSS Score
0.001
Published
2021-02-06
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
CVSS Score
9.8
EPSS Score
0.011
Published
2020-02-17
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.
CVSS Score
7.5
EPSS Score
0.034
Published
2020-02-05
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
CVSS Score
5.9
EPSS Score
0.019
Published
2020-01-28
Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.
CVSS Score
7.5
EPSS Score
0.02
Published
2020-01-28
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
CVSS Score
9.8
EPSS Score
0.067
Published
2020-01-24
Review Board: URL processing gives unauthorized users access to review lists
CVSS Score
4.3
EPSS Score
0.005
Published
2019-12-03
ReviewBoard: has an access-control problem in REST API
CVSS Score
7.5
EPSS Score
0.01
Published
2019-12-02
openslp: SLPIntersectStringList()' Function has a DoS vulnerability
CVSS Score
7.5
EPSS Score
0.462
Published
2019-12-02
Page 1