Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,386

Export CSV
CVE-2024-4947

chromium-browser: Type Confusion in V8

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS 15.2% KEV · Listed
Vendors
Fedoraproject Google
Products
Fedora Chrome
CVE-2024-32462

Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Flatpak Redhat
Products
Fedora Flatpak Enterprise Linux and 4 more
CVE-2024-31459

Cacti RCE vulnerability by file include in lib/plugin.php

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, there is a file inclusion issue in the `lib/plugin.php` file. Combined with SQL injection vulnerabilities, remote code execution can be implemented. There is a file inclusion issue with the `api_plugin_hook()` function in the `lib/plugin.php` file, which reads the plugin_hooks and plugin_config tables in database. The read data is directly used to concatenate the file path which is used for file inclusion. Version 1.2.27 contains a patch for the issue.

CVSS 3.1 · 8.1 High EPSS 2.7% KEV · Not listed
Vendors
Cacti Fedoraproject
Products
Cacti Fedora
CVE-2024-31445

SQL Injection vulnerability in automation_get_new_graphs_sql

Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.

CVSS 3.1 · 8.8 High EPSS 26.2% KEV · Not listed
Vendors
Cacti Fedoraproject
Products
Cacti Fedora
CVE-2022-24765

Uncontrolled search for the Git directory in Git for Windows

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.

CVSS 3.1 · 6 Medium EPSS 1.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Xcode Debian Linux Fedora and 4 more
CVE-2022-24302

python-paramiko: Race condition in the write_private_key_file function

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.

CVSS 3.1 · 5.9 Medium EPSS 2.1% KEV · Not listed
Vendors
Debian Fedoraproject Paramiko and 1 more
Products
Debian Linux Fedora Paramiko and 3 more
CVE-2024-3044

Graphic on-click binding allows unchecked script execution

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Fedoraproject Libreoffice and 1 more
Products
Debian Linux Fedora Libreoffice and 1 more
CVE-2021-29510

Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Pydantic
Products
Fedora Pydantic
CVE-2024-28176

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Jose Project Redhat
Products
Fedora Jose Acm and 5 more
CVE-2018-14881

tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2018-14467

tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more