SUSE-SU-2022:0857-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877. - Allow CRYPTOTHREADIDsetcallback to be called with NULL parameter bsc1196249...

Users Can Frontrun Token Distributions Using Flashloans

Lines of code Vulnerability details Impact The collector suite of contracts will actively send ANC token distributions to staked ANC token holders. However, because it is known beforehand that a distribution will be made to the governance contract, users can abuse this to frontrun distributions b...

GSD-2022-1000556 net/smc: Avoid overwriting the copies of clcsock callback functions

net/smc: Avoid overwriting the copies of clcsock callback functions This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.11 by commit...

PT-2022-28830

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.16.8 through 5.16.10 Description The issue is related to overwriting copies of clcsock callback functions in the net/smc component. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2022-28743

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15.22 through v5.15.24 Description The issue is related to overwriting copies of clcsock callback functions in the net/smc component. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-28917

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.16.5 Description A potential security issue exists due to an EOVERFLOW in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linu...

PT-2022-28440

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 5.4.82 through 5.4.176 Description A potential security issue exists due to an EOVERFLOW in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Lin...

PT-2022-28487

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.97 Description A potential security issue exists due to an EOVERFLOW in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-28551

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.15.19 Description A potential security issue exists due to an EOVERFLOW in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Lin...

PT-2022-28362

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.300 Description A potential security issue exists due to an EOVERFLOW in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-28383

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.14.211 through 4.14.264 Description The issue is related to an EOVERFLOW fix in the ipheth rcvbulk callback function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

Reentrancy allows commenter to overwrite own comments

Lines of code Vulnerability details Since the Lens platform is a blockchain-based social media platform, it's important that information relevant to users be emitted so that light clients need not continually refer to the blockchain, which can be expensive. From the docs: Events are emitted at...

CVE-2022-0212

The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0212

The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-0212: Improper Neutralization of Input During Web Page Generation

The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-21724 Unchecked Class Instantiation when providing Plugin Classes

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based o...

Mageia: Security Advisory (MGASA-2014-0291)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-2546

Name of the Vulnerable Software and Affected Versions Lenovo Notebook models affected versions not specified Description A potential issue in the SMI callback function used in the Legacy BIOS mode driver may allow an attacker with local access and elevated privileges to execute arbitrary code. Th...

PT-2022-37194

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-use-after-free READ 8 crash has been reported. The crash involves the pdfi cspace free callback, gs cspace final, and alloc restore step in function...

Possible Re-entrancy in _sendSherRewardsToOwner

Handle static Vulnerability details Vulnerability details Impact If the SHER token performs a callback, such as in ERC-777 tokens, when performing transfers, the sendSherRewardsToOwner function can be run multiple times to extract more rewards than should be available for a single NFT. Proof of...