Updated golang packages fix security vulnerability

encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash CVE-2022-24675 crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or...

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

...

SUSE: Security Advisory (SUSE-SU-2022:1411-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 Security Update : go1.18 (SUSE-SU-2022:1410-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1410-1 advisory. - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of...

PT-2022-13852

Name of the Vulnerable Software and Affected Versions Videos sync PDF WordPress plugin versions 1.7.4 and earlier Description The issue arises from the plugin not validating the p parameter before using it in an include statement, potentially leading to Local File Inclusion issues. Recommendation...

CVE-2022-1392: Improper Limitation of a Pathname to a Restricted Directory

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues...

GSD-2022-1001243 Bluetooth: hci_serdev: call init_rwsem() before p->open()

Bluetooth: hciserdev: call initrwsem before p-open This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-29826

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to a potential security vulnerability in the Linux Kernel. It involves the hci serdev component, where the init rwsem function is not called before p-open. The actual...

PT-2022-18766

Name of the Vulnerable Software and Affected Versions Student Grading System version 1.0 Description A SQL injection issue was found in the Student Grading System. The issue can be exploited via the "/student-grading-system/rms.php?page=student p&id=" API endpoint, where the id variable is...

AZL-9547 CVE-2022-28327 affecting package golang for versions less than 1.18.3-1

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

Input validation

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

CVE-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

webTareas SQL注入漏洞

webTareas is a web-based open source collaboration tool. The product supports project management, bug tracking, content management and meeting management. A SQL injection vulnerability exists in webTareas version 2.4p3 and earlier versions, which stems from the $uq parameter of...

The vulnerability of the OpenSSL library, related to errors in managing cryptographic keys, allows a hacker to recover secret ECDSA P-256 keys.

The vulnerability of the OpenSSL library is related to errors in the management of cryptographic keys. Exploiting this vulnerability could allow an attacker to recover encrypted keys of the ECDSA P-256 type...

CVE-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

CVE-2022-28327: Undefined Security Weakness

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

CVE-2022-28327

CVE-2022-28327 affects Go's crypto/elliptic P-256 in Go up to versions before 1.17.9 and 1.18.x before 1.18.1, where a crafted long scalar input can cause a panic in ScalarMult/ScalarBaseMult, leading to availability impact. Affected component: crypto/elliptic P-256. Mitigation: upgrade Go to 1.1...

CVE-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

PT-2022-36949

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description A heap-buffer-overflow WRITE 8 crash has been reported, with a crash state involving doemit, doinsert, and p ere. The estimated number of potentially affected devices worldwide is not...

PT-2022-18962

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.17.9 Go versions 1.18.x prior to 1.18.1 Description The issue allows a panic via long scalar input in the generic P-256 feature in crypto/elliptic. A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or...