DENX U-Boot 缓冲区错误漏洞

DENX U-Boot is a content management system. A security vulnerability exists in versions prior to DENX U-Boot v2022.07, which stems from a flaw in the metadata read process, and U-Boot's squash file system contains a heap-based buffer overflow vulnerability...

PT-2025-26016

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel, specifically with the btrfs filesystem. On zoned filesystems, data write out is limited by max zone append size, and a large ordered extent is...

Oracle Linux 7 : containerd (ELSA-2021-15790)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-15790 advisory. - Address CVE-2021-32760 docker-cli - updated containerd minimum version to 1.4.8 to address CVE-2021-32760. docker-engine Tenable has extracted the preceding...

Oracle Linux 7 : runc (ELSA-2021-14902)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-14902 advisory. 1.0.0-1.rc95 - Addresses CVE-2021-30465 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessu...

Important: kernel

Issue Overview: A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege CAPSYSADMIN or CAPSYSRAWIO to create issues with confidentiality. CVE-2022-0494 An information...

Fedora: Security Advisory for golang-github-google-slothfs (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-34482

An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from...

[SECURITY] Fedora 36 Update: golang-github-intel-goresctrl-0.2.0-6.fc36

Golang library for managing resctrl filesystem...

[SECURITY] Fedora 36 Update: golang-github-google-slothfs-0-0.11.20200727git59c1163.fc36

SlothFS is a FUSE filesystem that provides light-weight, lazily downloaded, read-only checkouts of manifest-based Git projects. It is intended for use wi th Android...

[SECURITY] Fedora 36 Update: golang-github-containerd-continuity-0.2.2-3.fc36

A transport-agnostic, filesystem metadata manifest system...

GO-2022-0230 Improper limitation of path name in github.com/containernetworking/cni

The FindInPath function is vulnerable to directory traversal attacks, potentially permitting attackers to execute arbitrary binaries. This function does not sanitize its plugin parameter, so parameter names containing "../" or other such elements may reference arbitrary locations on the filesyste...

CVE-2022-34816

Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-34800

Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-34799

Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

PT-2022-22358 · Jenkins · Jenkins Jigomerge Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Jigomerge Plugin versions 0.9 and earlier Description: The issue allows passwords to be stored unencrypted in job config.xml files on the Jenkins controller. Users with Extended Read permission or access to the Jenkins controller file...

The vulnerability of the btrfs_alloc_tree_b function (fs/btrfs/extent-tree.c) in the file system of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the btrfsalloctreeb function fs/btrfs/extent-tree.c in the file system of the Linux operating system is related to improper locking of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

GSD-2022-1003325 f2fs: fix dereference of stale list iterator after loop body

f2fs: fix dereference of stale list iterator after loop body This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

GSD-2022-1003201 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.47 by commit...

GSD-2022-1002937 ext4: fix warning in ext4_handle_inode_extension

ext4: fix warning in ext4handleinodeextension This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

GSD-2022-1002532 ceph: flush the mdlog for filesystem sync

ceph: flush the mdlog for filesystem sync This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...