Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Fedora
(Fedoraproject)| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-02-27 | CVE-2020-6418 | Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Debian_linux, Fedora, Chrome, Enterprise_linux_desktop, Enterprise_linux_server, Enterprise_linux_workstation | 8.8 | ||
| 2020-02-27 | CVE-2020-9428 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing. | Debian_linux, Fedora, Leap, Wireshark | 7.5 | ||
| 2020-02-27 | CVE-2020-9430 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validating a length field. | Debian_linux, Fedora, Leap, Wireshark | 7.5 | ||
| 2020-02-27 | CVE-2020-9431 | In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations. | Debian_linux, Fedora, Leap, Wireshark | 7.5 | ||
| 2020-02-28 | CVE-2020-5247 | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is... | Debian_linux, Fedora, Puma, Ruby | 7.5 | ||
| 2020-03-05 | CVE-2020-9402 | Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. | Ubuntu_linux, Debian_linux, Django, Fedora, Steelstore_cloud_integrated_storage | 8.8 | ||
| 2020-03-07 | CVE-2020-9281 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax). | Ckeditor, Drupal, Fedora, Agile_plm, Application_express, Banking_enterprise_default_management, Banking_enterprise_default_managment, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools, Siebel_apps_\-_customer_order_management, Webcenter_portal | 6.1 | ||
| 2020-03-10 | CVE-2020-9440 | A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor. | Ckeditor, Fedora, Webspellchecker | 6.1 | ||
| 2020-03-11 | CVE-2020-1733 | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target... | Debian_linux, Fedora, Ansible, Ansible_tower, Cloudforms_management_engine, Openstack | 5.0 | ||
| 2020-03-12 | CVE-2020-10108 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. | Ubuntu_linux, Debian_linux, Fedora, Solaris, Zfs_storage_appliance_kit, Twisted | 9.8 |