CVE-2021-43138

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...

Async 安全漏洞

Async is a utility module from Caolan McMahon Personal Developer in the UK. It is intended for use with asynchronous JavaScript. A security vulnerability exists in Async 3.2.1 and earlier, which stems from the mapValues method. An attacker could gain privileges via the mapValues method...

CVE-2021-43138: Improperly Controlled Modification of Object Prototype Attributes

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...

PT-2022-7301

Name of the Vulnerable Software and Affected Versions Async versions 2.x through 2.6.3 Async versions 3.x through 3.2.1 Description The issue is related to the mapValues function in the Async library, which is used for working with asynchronous JavaScript. It involves the incorrect control of...

CVE-2021-43138

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...

CVE-2021-43138

CVE-2021-43138 affects Async (lib/iterator.js) where mapValues() enables prototype pollution via createObjectIterator, allowing a malicious user to obtain privileges. Affected: Async before 2.6.4 and 3.x before 3.2.2. Root cause: prototype pollution in Object prototype through pollution of mapVal...

Safe SVG < 1.9.10 - SVG Sanitisation Bypass

The sanitisation step of the plugin can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent mainly XSS, but depending on further use of uploaded SVG...

GSD-2022-1000690 btrfs: fallback to blocking mode when doing async dio over multiple extents

btrfs: fallback to blocking mode when doing async dio over multiple extents This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.13 by commit...

PT-2022-28964

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.13 Description The issue is related to the btrfs filesystem, specifically when handling async dio operations over multiple extents, where it falls back to blocking mode. The actual impact and potential for...

GSD-2022-1000607 ceph: properly put ceph_string reference after async create attempt

ceph: properly put cephstring reference after async create attempt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.5 by commit...

PT-2022-28881

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.5 Description The issue is related to the handling of ceph string references after an async create attempt. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

MSTICPy January 2022 hackathon highlights

During the month of January 2022, the Microsoft Threat Intelligence Center MSTIC ran its inaugural hackathon for the open-source Jupyter and Python Security Tools library, MSTICPy. We asked the security community for their contributions to expand and improve MSTICPy’s features and capabilities, a...

PT-2022-7503

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.10.0 Description The vulnerability is related to the KVM Kernel-based Virtual Machine component of the Linux kernel, specifically in the x86/mmu Memory Management Unit module. The issue arises from the async pagefault...

GSD-2022-1000245 ceph: properly put ceph_string reference after async create attempt

ceph: properly put cephstring reference after async create attempt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...

CLSA-2022-1644927474 Fix of CVE: CVE-2021-4115

CVE-2021-4115: file decriptor leak due to incorrect handling of async streams in src/polkit/polkitsystembusname.c...

CLSA-2022-1644927378 Fix of CVE: CVE-2021-4115

CVE-2021-4115: file decriptor leak due to incorrect handling of async streams in src/polkit/polkitsystembusname.c...

Mageia: Security Advisory (MGASA-2015-0212)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-24044

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error,...

PT-2022-28306

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.261 Description The issue concerns a fix for async free space accounting for empty parcels in the binder. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

async-fetcher (>=0.1.1, <=0.1.2), exonum (0.9.7) +2 more potentially affected by CVE-2018-25024 +2 more via actix-web (>=0.2.1, <=0.7.3)

actix-web CARGO version =0.2.1, =0.1.1, =0.1.0, =0.1.3 - sockjs 0.1.0 Source cves: CVE-2018-25024, CVE-2018-25025, CVE-2018-25026 Source advisory: OSV:GHSA-7X36-H62W-VW65...