PT-2022-32675

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.56 Description The issue is related to the use of separate src/dst nodes when preloading css sets for migration in cgroup. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-32459

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.13 Description The issue is related to the use of separate src/dst nodes when preloading css sets for migration in cgroup. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-32972

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.16 through 5.4.206 Description The issue is related to the use of separate src/dst nodes when preloading css sets for migration in cgroup. The actual impact and attack plausibility have not yet been proven...

PT-2022-32847

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.132 Description The issue is related to the use of separate src/dst nodes when preloading css sets for migration in cgroup. The actual impact and attack plausibility have not yet been proven. Recommendation...

GO-2022-0316 Incorrect calculation in github.com/open-policy-agent/opa

Pretty-printing an AST that contains synthetic nodes can change the logic of some statements by reordering array literals...

CVE-2022-2553

A flaw was found in booth in the way it handles the authfile directive in configuration files, which causes authentication to be skipped between nodes. As a result, an attacker-controlled node that does not have the correct authentication key does not prevent communication with other nodes in the...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the function exprtraversenodespost in libyasm/expr.c. Remediation There is no fixed version for yasm. References - GitHub Gist - GitHub Issue Credit: Clingto...

CVE-2022-29962

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials but may often be disabled in production. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350...

CVE-2022-29962

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials but may often be disabled in production. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350...

CVE-2022-29962

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials but may often be disabled in production. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350...

PT-2022-10258

Name of the Vulnerable Software and Affected Versions yasm version 1.3.0 Description A use-after-free issue was discovered in the expr traverse nodes post function located in the libyasm/expr.c file. This issue affects the functionality of the software, potentially leading to instability or...

Popular NFT Marketplace Phished for $540M

Axie Infinity, a popular destination for 3 million traders of in-game collectible non-fungible tokens, reportedly lost $540M in cryptocurrency in a recruiting-themed spear phishing attack. The perpetrators of the crime are believed to be an advanced persistent threat group with ties to North...

Fake job offer leads to $600 million theft

Back in March, popular NFT battler Axie Infinity lay at the heart of a huge cryptocurrency theft inflicted on the Ronin network. From the Ronin newsletter: There has been a security breach on the Ronin Network. Earlier today, we discovered that on March 23rd, Sky Mavis’s Ronin validator nodes and...

PT-2022-31191

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.17 through v5.17.14 Description A memory leak issue was discovered in the Linux Kernel. The issue is related to the mm/huge memory component and is caused by a leak in xarray nodes. The actual impact and attack...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2022-29162)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd's runc version where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2022-31030)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all...

CVE-2022-30034

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

Authentication flaw

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

PYSEC-2022-42973

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...

CVE-2022-30034

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes...