SUSE CVE-2021-43809

Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself...

CLSA-2023-1675984682 sudo: Fix of CVE-2023-22809

CVE-2023-22809: do not permit editor arguments to include "--"...

CLSA-2023-1675984342 sudo: Fix of CVE-2023-22809

CVE-2023-22809: do not permit editor arguments to include "--"...

Security Bulletin: Vulnerability in min-dash affects IBM Process Mining [CVE-2021-23460]

Summary There is a vulnerability in min-dash that could allow a remote attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. CVE-2021-23460 Vulnerability Details...

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

Cybersecurity researchers have disclosed details of two security flaws in the open source ImageMagick software that could potentially lead to a denial-of-service DoS and information disclosure. The two issues, which were identified by Latin American cybersecurity firm Metabase Q in version...

CVE-2022-4735

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch i...

Cross site scripting

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch i...

CVE-2022-4735 asrashley dash-live DOM Node media.js ready cross site scripting

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch i...

CVE-2022-4735 asrashley dash-live DOM Node media.js ready cross site scripting

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch i...

CVE-2022-4735 asrashley dash-live DOM Node media.js ready cross site scripting

A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch i...

CVE-2022-4735

The CVE-2022-4735 entry concerns asrashley dash-live. It affects the DOM Node Handler’s static/js/media.js, specifically the ready function, which is vulnerable to cross-site scripting that can be triggered remotely. The available connected documents confirm a patch named 24d01757a5319cc14c4aa1d8...

dash-live 跨站脚本漏洞

dash-live is a library by Alex Ashley, a personal developer. Fake DASH Live profile endpoints using static assets. A cross-site scripting vulnerability exists in dash-live, which stems from a ready function in the static/js/media.js file of its DOM Node Handler component that allows an attacker t...

Realtek RTL8111FP-CG License Issue Vulnerability

The Realtek RTL8111FP-CG is an Ethernet controller. An authorization issue vulnerability exists in Realtek RTL8111FP-CG Firmware prior to version 5.0.23, which stems from a lack of authorization for the Dash remote management feature, and can be exploited by an unauthenticated attacker on an...

CVE-2022-32966

RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service...

CVE-2022-32966

RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service...

CVE-2022-32967

RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as serial number and server information...

CVE-2022-32967

RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as serial number and server information...

Authorization

RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service...

CVE-2022-32967

Realtek RTL8111EP-CG/RTL8111FP-CG DASH function contains a hard-coded password. An unauthenticated physical attacker can exploit this during a reboot triggered by another user to access partial system information (e.g., serial number, server information). Affected firmware versions are prior to 3...

CVE-2022-32966 Realtek RTL8111FP-CG - Missing Authorization

RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect to DASH service port to disrupt service...