Fedora Project Fedora 38

Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Null Pointer Dereference in mask_cidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewrite command.

Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium)

Unchecked access to font glyph info in xrdp

Libx11: out-of-bounds memory access in _xkbreadkeysyms()

Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)

Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an unauthenticated user to potentially enable denial of service via adjacent access.

Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)

Ipa: invalid csrf protection

Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

Moodle: stored xss and potential idor risk in wiki comments

Keylime: challenge-response protocol bypass during agent registration

Out-of-bounds read information disclosure vulnerability

Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)

x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334).

Heap buffer overflow in virtio_crypto_sym_op_helper()

Buffer Underwrite in ares_inet_net_pton()

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Apache HTTP Server: HTTP Response Splitting in multiple modules

Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti

Imagemagick: heap use-after-free in coders/bmp.c

NULL Pointer Dereference in vim/vim

Floating point exception in src/voc.c

Floating point exception in src/aiff.c

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti

Reflected Cross-site Scripting in graphs_new.php in Cacti

Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti

Stored Cross-site Scripting on graphs.php data template formated name view in Cacti

Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti

Stored Cross-site Scripting on data_debug.php datasource path view in Cacti

Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti

Stored Cross-site Scripting on data_sources.php device name view in Cacti

Stored Cross-Site-Scripting on reports_admin.php device name in Cacti

ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process

aiohttp vulnerable to XSS on index pages for static file handling

Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).

Moodle: xss risk when previewing data in course upload tool