PT-2022-7474

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a hung thread due to erroneous iotlb entries in the vhost component of the Linux kernel. Specifically, in vhost iotlb add range ctx, the range size can overflow t...

PT-2022-7477 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel's tipc component can cause a kernel panic when enabling a bearer on a node. This occurs due to a null-pointer dereference in the tipc mon prep...

istio:fuzz_render_manifests: Crash in _cgo_try_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5603617795604480 Project: istio Fuzzing Engine: libFuzzer Fuzz Target: fuzzrendermanifests Job Type: libfuzzerasanistio Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0000004caf6c Crash State: cgotrypthreadcreate xcgosysthreadcreat...

jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop indefinitely until...

PT-2022-36844

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description A heap-buffer-overflow WRITE 4 crash has been reported. The crash involves the row mt worker hook and thread loop functions. No information is available about the estimated number of...

Atlassian Jira Server ViewInstrumentation.jspa Cross-site Request Forgery Vulnerability

Atlassian Jira Service is the server version of an IT service desk and request tracking system from Atlassian Australia. The Atlassian Jira Server is vulnerable to cross-site request forgery, which stems from an application/secure/admin/ViewInstrumentation.jspa endpoint that does not adequately...

abi_stable (>=0.4.0, <=0.8.4), acidalia (0.1.3) +1469 more potentially affected by CVE-2022-23639 via crossbeam-utils (>=0.1.0, <=0.7.2)

crossbeam-utils CARGO version =0.1.0, =0.4.0, =0.0.1, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.2, =0.3.0, =0.7.5, =0.8.1 - agilulf 0.1.0 - agilulfdriver 0.1.0 and more Source cves: CVE-2022-23639 Source advisory: OSV:GHSA-QC84-GQF4-9926...

SquirrelWaffle Adds a Twist of Fraud to Exchange Server Malspamming

SquirrelWaffle – the newish malware loader that first showed up in September – once again got its scrabbly little claws into an unpatched Microsoft Exchange server to spread malspam with its tried-and-true trick of hijacking email threads. That’s the same-old, same-old, as in, a SquirrelWaffle...

CVE-2021-43953

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery CSRF vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are befor...

Atlassian Jira Server and Data Center cross-site request forgeing vulnerabilities

Atlassian Jira Service is the server version of an IT service desk and request tracking system from Atlassian Australia. The Atlassian Jira Server is vulnerable to cross-site request forgery, which stems from an application/secure/admin/ViewInstrumentation.jspa endpoint that does not adequately...

DEBIAN-CVE-2022-23633

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

CVE-2022-23633: Exposure of Sensitive Information to an Unauthorized Actor

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

CVE-2022-23633 Exposure of sensitive information in Action Pack

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

GHSA-C582-C96P-R5CQ Memory exhaustion in Tensorflow

Impact The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory: python import tensorflow as tf y = tf.rawops.ThreadPoolHandlenumthreads=0x60000000,displayname='tf' This is because the numthreads argument is only checked to not be...

AlmaLinux 8 : glibc (ALSA-2021:4358)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4358 advisory. - The nameserver caching daemon nscd in the GNU C Library aka glibc or libc6 2.29 through 2.33, when processing a request for netgroup lookup, may crash d...

[SECURITY] Fedora 34 Update: rust-thread_local-1.1.4-1.fc34

Per-object thread-local storage...

Fedora: Security Advisory for rust-thread_local (FEDORA-2022-7ec8bda833)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-21732 Memory exhaustion in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory. This is because the numthreads argument is only checked to not be negative, but there is no upper bound on its value. Th...

CVE-2022-21732

Tensorflow is an Open Source Machine Learning Framework. The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory. This is because the numthreads argument is only checked to not be negative, but there is no upper bound on its value. Th...

Google TensorFlow security vulnerabilities

TensorFlow is an end-to-end open source machine learning platform. It has a comprehensive and flexible ecosystem of tools, libraries, and community resources that help researchers push the boundaries of advanced machine learning techniques and enable developers to easily build and deploy...