CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

AZL-38236 CVE-2022-48285 affecting package mozjs for versions less than 102.15.1-1

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

Fedora 37 : yarnpkg (2023-ce8943223c)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce8943223c advisory. Add patches for CVE-2021-43138, CVE-2022-3517, CVE-2020-7677 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 36 : yarnpkg (2023-18fd476362)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-18fd476362 advisory. Add patches for CVE-2021-43138, CVE-2022-3517, CVE-2020-7677 Tenable has extracted the preceding description block directly from the Fedora security...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Crlf injection

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Critical: Red Hat Security Advisory: Satellite 6.12.1 Async Security Update

Updated Satellite 6.12 packages that fixes critical security bugs and several regular bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

Async injection vulnerability

Async is a utility module from Caolan McMahon Personal Developer in the UK. It is used to work with asynchronous JavaScript. A security vulnerability exists in Async HTTP Client version 1.13.2 and earlier versions. An attacker exploiting this vulnerability could open source a new HTTP header fiel...

CVE-2023-0040: Improper Neutralization of CRLF Sequences

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040

CVE-2023-0040 affects Async HTTP Client prior to 1.13.2. The root cause is insufficient validation of HTTP header field values, enabling CRLF injection that can inject new HTTP header fields or requests into the data stream. Impact described in the connected documents notes that remote servers ma...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

CVE-2023-0040

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted...

aionefit-updated (0.15.0), async-notify (>=0.5.17, <=0.7.0) +4 more potentially affected by CVE-2022-45197 via slixmpp (>=1.1.0, <=1.8.2)

slixmpp PYPI version =1.1.0, =0.5.17, =0.7.3, =0.1.1, =2.0.11, =2.3.9 - slixmppbot 1.0.8 Source cves: CVE-2022-45197 Source advisory: GHSA-Q6CQ-M9GM-6Q2F...

aionefit-updated (0.15.0), async-notify (>=0.5.17, <=0.7.0) +4 more potentially affected by CVE-2022-45197 via slixmpp (>=1.1.0, <=1.8.2)

slixmpp PYPI version =1.1.0, =0.5.17, =0.7.3, =0.1.1, =2.0.11, =2.3.9 - slixmppbot 1.0.8 Source cves: CVE-2022-45197 Source advisory: MEND:CVE-2022-45197...

GSD-2022-1007339 net/mlx5: Fix possible use-after-free in async command interface

net/mlx5: Fix possible use-after-free in async command interface This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.223 by commit...

GSD-2022-1007165 net/mlx5: Fix possible use-after-free in async command interface

net/mlx5: Fix possible use-after-free in async command interface This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.153 by commit...

GSD-2022-1006938 net/mlx5: Fix possible use-after-free in async command interface

net/mlx5: Fix possible use-after-free in async command interface This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.77 by commit...

GSD-2022-1006618 net/mlx5: Fix possible use-after-free in async command interface

net/mlx5: Fix possible use-after-free in async command interface This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.7 by commit...

PT-2022-35420

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.1 through v5.10.152 Description A potential issue exists in the async command interface of the net/mlx5 driver, which may lead to a use-after-free scenario. The actual impact and attack plausibility have not yet been...