Vulnerabilities > Fedoraproject > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-04-09 | CVE-2019-9844 | Cross-site Scripting vulnerability in multiple products simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI. | 6.1 |
| 2019-04-08 | CVE-2019-11026 | Uncontrolled Recursion vulnerability in multiple products FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. | 6.5 |
| 2019-04-07 | CVE-2019-10740 | Cleartext Transmission of Sensitive Information vulnerability in multiple products In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. | 4.3 |
| 2019-04-04 | CVE-2019-3886 | An incorrect permissions check was discovered in libvirt 4.8.0 and above. | 5.4 |
| 2019-03-27 | CVE-2019-3877 | Open Redirect vulnerability in multiple products A vulnerability was found in mod_auth_mellon before v0.14.2. | 6.1 |
| 2019-03-27 | CVE-2019-9917 | Improper Input Validation vulnerability in multiple products ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding. | 6.5 |
| 2019-03-26 | CVE-2019-6341 | Cross-site Scripting vulnerability in multiple products In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. | 5.4 |
| 2019-03-26 | CVE-2019-3851 | A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. | 4.3 |
| 2019-03-25 | CVE-2019-3838 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. | 5.5 |
| 2019-03-25 | CVE-2019-3835 | Missing Authorization vulnerability in multiple products It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. | 5.5 |