PT-2022-22639

Name of the Vulnerable Software and Affected Versions Teamplus Pro affected versions not specified Description The issue is related to an 'allocation of resource without limits or throttling' vulnerability in the thread subject field of the community discussion feature. A remote attacker with...

CVE-2022-35221: Allocation of Resources Without Limits or Throttling

Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing...

CVE-2022-35221

Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing...

mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/dscompress.cc, when an error occurs pthreadcreate returns a nonzero value while executing the method createworkerthreads, the held lock is not released correctly, which allows local users to trigger a denial of...

What Talos Incident Response learned from a recent Qakbot attack hijacking old email threads

By Nate Pors and Terryn Valikodath. Executive summary In a recent malspam campaign delivering the Qakbot banking trojan, Cisco Talos Incident Response CTIR observed the adversary using aggregated, old email threads from multiple organizations that we assess were likely harvested during the 2021...

Atlassian Jira 8.14.x < 8.20.5 Cross-Site Request Forgery

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.16 or 8.14.x prior to 8.20.5. It is, therefore, affected by a vulnerability allowing unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring...

GHSA-WGMR-MF83-7X4J Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

Description Invalid HTTP/2 requests for example, invalid URIs are incorrectly handled by writing a blocking error response directly from the selector thread. If the client manages to exhaust the HTTP/2 flow control window, or TCP congest the connection, the selector thread will be blocked trying ...

GSD-2022-1003521 powerpc/kasan: Force thread size increase with KASAN

powerpc/kasan: Force thread size increase with KASAN This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...

GSD-2022-1003267 powerpc/kasan: Force thread size increase with KASAN

powerpc/kasan: Force thread size increase with KASAN This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

GSD-2022-1002954 powerpc/kasan: Force thread size increase with KASAN

powerpc/kasan: Force thread size increase with KASAN This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.15 by commit...

GSD-2022-1002649 lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP

lkdtm/bugs: Don't expect thread termination without CONFIGUBSANTRAP This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

GSD-2022-1002617 powerpc/kasan: Force thread size increase with KASAN

powerpc/kasan: Force thread size increase with KASAN This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

PT-2022-31556

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.47 Description The issue is related to thread termination without CONFIG UBSAN TRAP. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2022-31258

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15 through v5.17.14 Description The issue is related to thread termination without CONFIG UBSAN TRAP. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.15...

PT-2022-30912

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.4 Description The issue is related to thread termination without CONFIG UBSAN TRAP. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5.15 and fixed in Linux...

CVE-2022-31100 Reachable Assertion in rulex

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to...

OESA-2022-1722 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in the libvirt nwfilter driver. The...

UBUNTU-CVE-2014-125020

A vulnerability has been found in FFmpeg 2.0 and classified as critical. This vulnerability affects the function decodeupdatethreadcontext. The manipulation leads to memory corruption. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue...

PT-2022-7780

Name of the Vulnerable Software and Affected Versions FFmpeg version 2.0 Description A critical issue has been found in the function decode update thread context, leading to memory corruption. The attack can be initiated remotely. Recommendations For FFmpeg version 2.0, apply a patch to fix this...

Hunt-Sleeping-Beacons - Aims To Identify Sleeping Beacons

The idea of this project is to identify beacons which are unpacked at runtime or running in the context of another process. To do so, I make use of the observation that beacons tend to call Sleep between their callbacks. A call to sleep sets the state of the thread to DelayExecution which is take...