AZL-9918 CVE-2022-31030 affecting package moby-containerd for versions less than 1.6.6-1

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory...

Medium: containerd

Issue Overview: A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to...

5 Linux malware families SMBs should protect themselves against

There’s no shortage of reasons why an SMB might use Linux to run their business: There are plenty of distros to choose from, it’s generally free, and perhaps above all — it’s secure. The common wisdom goes that Linux malware is rare, and for the most part this is true. Thanks to its built-in...

CVE-2022-1712

The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Malicious code in sync-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4acb1678e3420191321cd1a4385ce0b4bee92a3428a42666620c96fc28a35eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6389 Malicious code in sync-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4acb1678e3420191321cd1a4385ce0b4bee92a3428a42666620c96fc28a35eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-37071 CVE-2022-1708 affecting package cri-o for versions less than 1.21.7-1

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a...

Malicious code in sync-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36a88f33209b094f3105a202873bb5e94e4f0053c82ea88e32b3cd1d3f7bea28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6388 Malicious code in sync-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36a88f33209b094f3105a202873bb5e94e4f0053c82ea88e32b3cd1d3f7bea28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-1359 · Unknown · File Sync Client

Name of the Vulnerable Software and Affected Versions: file sync client affected versions not specified Description: The issue is related to a path traversal error in the finishLsImpl function of file sync client.cpp. This error could allow access to the host's files, potentially leading to local...

ASB-A-209438553

In finishLsImpl of filesyncclient.cpp, there is a possible way to access host's files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Router: Transferring Token to the Pair contract will cause future liquidity providers to lose funds

Lines of code Vulnerability details Impact Same as code-423n4/2022-01-elasticswap-findings146 In the current implementation, the amount of LP tokens to be minted when addLiquidity is calculated based on the ratio between the amount of newly added tokens and the reserve variable in the Pair...

org.jenkins-ci.plugins:scm-sync-configuration (>=0.0.6, <=0.0.9), org.jenkins-ci.plugins:scm2job (>=2.1, <=2.5) potentially affected by CVE-2021-21698 via org.jenkins-ci.plugins:subversion (1.39)

org.jenkins-ci.plugins:subversion MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:scm-sync-configuration =0.0.6, =2.1, =2.5 Source cves: CVE-2021-21698...

io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45), org.jenkins-ci.plugins:github-oauth (>=0.25, <=0.33) +1 more potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (3.0.0)

org.jenkins-ci.plugins:git MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =y, =0.25, =0.33 - org.jenkins-ci.plugins:stash-pullrequest-build...

Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption

An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled...

GHSA-5R9G-J7JJ-HW6C Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption

An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled...

GHSA-RH4W-94HH-9943 MutexGuard::map can cause a data race in safe code

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U. This could of led to data races in safe Rust code when a closure used in MutexGuard::map returns U that is unrelated to T. The issue was...

MutexGuard::map can cause a data race in safe code

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U. This could of led to data races in safe Rust code when a closure used in MutexGuard::map returns U that is unrelated to T. The issue was...

org.jenkins-ci.plugins:scm-sync-configuration (>=0.0.6, <=0.0.9), org.jenkins-ci.plugins:scm2job (>=2.1, <=2.5) potentially affected by CVE-2020-2304 via org.jenkins-ci.plugins:subversion (1.39)

org.jenkins-ci.plugins:subversion MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:subversion and may be impacted: - org.jenkins-ci.plugins:scm-sync-configuration =0.0.6, =2.1, =2.5 Source cves: CVE-2020-2304...

com.aliyun.www:aliyun-container-service-deploy (>=0.1.0, <=0.1.1), io.fabric8.jenkins.plugins:openshift-sync (>=y, <=1.0.45) +15 more potentially affected by CVE-2020-2223 via org.jenkins-ci.main:jenkins-core (1.651.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.aliyun.www:aliyun-container-service-deploy =0.1.0, =y, =1.0.4, =1.004, =1.0, =1.0.6,...