CVE-2022-35929

CVE-2022-35929 affects cosign prior to version 1.10.1. In cosign verify-attestation, using --type (default: custom) can yield a false positive when there is at least one attestation with a valid signature and no attestations of the type being verified. Repro example uses distroless image with a v...

CVE-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

sigstore Policy Controller 数据伪造问题漏洞

sigstore Policy Controller is a tool from sigstore, Inc. A data forgery issue vulnerability exists in versions prior to Policy Controller 0.2.1, which stems from a reporting false positive in Policy Controller that results in an admission when it should not have been...

CVE-2022-35929: Improper Verification of Cryptographic Signature

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

py-flask-security -- user redirect to arbitrary URL vulnerability

Snyk reports: This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerabilit...

Mind the Gap – How to Ensure Your Vulnerability Detection Methods are up to Scratch — The Hacker News

With global cybercrime costs expected to reach $10.5 trillion annually by 2025, it comes as little surprise that the risk of attack is companies' biggest concern globally. To help businesses uncover and fix the vulnerabilities and misconfigurations affecting their systems, there is an overabundan...

Information Exposure

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For...

Hackers can spoof commit metadata to create false GitHub repositories

By Deeba Ahmed Checkmarx security researchers have warned about an emerging new supply chain attack tactic involving spoofed metadata commits to present malicious… This is a post from HackRead.com Read the original post: Hackers can spoof commit metadata to create false GitHub repositories...

“Free UK visa” offers on WhatsApp are fakes

A student friend recently shared a WhatsApp message, unsure if it was scam. The message claims to offer an easy to route to free visas, housing, accommodation, and medicine access. Heres how we know it was a scam, and where it lead. It read as follows: UK GOVERNMENT JOB RECRUITMENT 2022: This is...

GSD-2022-1004087 x86/pm: Fix false positive kmemleak report in msr_build_context()

x86/pm: Fix false positive kmemleak report in msrbuildcontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.318 by commit...

GSD-2022-1003922 x86/pm: Fix false positive kmemleak report in msr_build_context()

x86/pm: Fix false positive kmemleak report in msrbuildcontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.247 by commit...

GSD-2022-1003808 x86/pm: Fix false positive kmemleak report in msr_build_context()

x86/pm: Fix false positive kmemleak report in msrbuildcontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...

GSD-2022-1003629 x86/pm: Fix false positive kmemleak report in msr_build_context()

x86/pm: Fix false positive kmemleak report in msrbuildcontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit...

GSD-2022-1003415 x86/pm: Fix false positive kmemleak report in msr_build_context()

x86/pm: Fix false positive kmemleak report in msrbuildcontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

GSD-2022-1003136 x86/pm: Fix false positive kmemleak report in msr_build_context()

x86/pm: Fix false positive kmemleak report in msrbuildcontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

PT-2022-31892

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.121 Description The issue is related to a false positive kmemleak report in the msr build context function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kern...

PT-2022-32350

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.318 Description The issue is related to a false positive kmemleak report in the msr build context function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...

PT-2022-31399

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description The issue is related to a false positive kmemleak report in the msr build context function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...

CVE-2022-30117

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

CVE-2022-30117

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...