Design/Logic Flaw

All versions of package asneg/opcuastack are vulnerable to Denial of Service DoS due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sending a specifically crafted OPC UA message...

PT-2022-17198 · Unknown · Asneg/Opcuastack

Name of the Vulnerable Software and Affected Versions: asneg/opcuastack versions affected versions not specified Description: The issue is related to a Denial of Service DoS condition due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in...

ASNeG OPC UA Stack 安全漏洞

ASNeG OPC UA Stack is an open source framework open source by ASNeG Germany. It is used to develop and distribute OPC UA client/server applications. A security vulnerability exists in ASNeG OPC UA Stack that stems from the lack of a handler to handle failures when unauthenticated data is forwarde...

NVIDIA graphics driver 安全漏洞

NVIDIA graphics driver is a graphics driver from NVIDIA Corporation. A security vulnerability exists in the NVIDIA graphics driver that originates from the Dynamic Boost D-Bus component not properly restricting access to its endpoints, which can be exploited by an attacker to cause a denial of...

USN-5547-1 nvidia-graphics-drivers-390, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-470, nvidia-graphics-drivers-470-server, nvidia-graphics-drivers-510, nvidia-graphics-drivers-510-server, nvidia-graphics-drivers-515, nvidia-graphics-drivers-515-server vulnerabilities

Le Wu discovered that the NVIDIA graphics drivers did not properly perform input validation in some situations. A local user could use this to cause a denial of service or possibly execute arbitrary code. CVE-2022-31607 Tal Lossos discovered that the NVIDIA graphics drivers incorrectly handled...

Security fix for the ALT Linux 10 package MySQL version 8.0.29-alt1

8.0.29-alt1 built July 5, 2022 Nikolai Kostrigin in task 302902 --- June 30, 2022 Nikolai Kostrigin - new version + fixes: CVE-2021-22570, CVE-2022-0778, CVE-2022-21454, CVE-2022-21457 + fixes: CVE-2022-21425, CVE-2022-21440, CVE-2022-21459, CVE-2022-21478 + fixes: CVE-2022-21479, CVE-2022-21418,...

CVE-2022-24436

A potential vulnerability in some Intel® processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure. Mitigation Currently, there is no mitigation for this flaw. Intel has provided some guidance to developers of...

new packages: boost

An update is available for boost. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

GHSA-GQRP-QHV8-PHRV Moodle Cross-site Scripting

moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user...

Moodle Cross-site Scripting

moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user...

Moodle Secure layout contained an insecure link in Boost theme

A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page...

GHSA-PJ45-HP8H-289R Moodle Secure layout contained an insecure link in Boost theme

A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page...

The vulnerability of software products for control, management, and simulation in TRUMPF TruTops Boost, TruTops Fab, and TruTops Monitor machines lies in the absence of an authentication procedure for the critical function, allowing attackers to execute commands with elevated privileges.

The vulnerability of software products for control, management, and simulation in TRUMPF TruTops Boost, TruTops Fab, and TruTops Monitor machines is related to the absence of an authentication procedure for the critical function. Exploiting this vulnerability could allow a malicious actor to...

AZL-26135 CVE-2018-25032 affecting package boost for versions less than 1.76.0-3

zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...

Unchecked feiAmount range

Lines of code Vulnerability details Impact BoosValue could be not safe. Proof of Concept The variable feiAmount is not used during the logic of the method canSafeBoostVault. According to the comment: The amount of Fei asset to check the Safe is authorized boost the Vault with. So this argument mu...

Mageia: Security Advisory (MGASA-2018-0220)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-41392

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API...

CVE-2021-41392

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API...

Command injection

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API...

CVE-2021-41392

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API...