aioload (0.3.2), fastgraphml (0.0.0) +6 more potentially affected by CVE-2022-40897 via setuptools (45.0.0)

setuptools PYPI version 45.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aioload 0.3.2 - fastgraphml 0.0.0 - graph-sc =0.0.1, =0.3.13, =0.3.16 - spriteutil-intek-2020-nqcuong96 1.0.0 Source cves: CVE-2022-40897...

appsquared (>=0.1.1, <=1.1.1), armadilloml (>=0.1.3, <=0.1.7) +6 more potentially affected by CVE-2022-40897 via setuptools (61.3.1)

setuptools PYPI version 61.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - appsquared =0.1.1, =0.1.3, =0.1.0, =1.0.2, =1.0.2, =0.2.0, =0.3.1 - sentraltimetable 2022.0.7 Source cves: CVE-2022-40897 Source advisory:...

Outlining a new SiestaGraph backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Foreign Affairs Office of an Association of Southeast Asian Nations ASEAN member is targeted by multiple threat actors who are coordinating active campaigns via a vulnerable Microsoft Exchange server...

AzureGraph - Azure AD Enumeration Over MS Graph

AzureGraph is an Azure AD information gathering tool over Microsoft Graph. Thanks to Microsoft Graph technology, it is possible to obtain all kinds of information from Azure AD, such as users, devices, applications, domains and much more. This application, allows you to query this data through th...

PT-2025-43082

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the ASoC Advanced Linux Sound Architecture audio graph card component. Specifically, a reference count leak exists in the graph for each link...

PT-2022-38116

Уязвимость функции graph for each link модуля sound/soc/generic/audio-graph-card.c поддержки звука SoC ядра операционной системы Linux связана с ошибками при обновлении счетчика ссылок. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2022-45283

Removed by vendor...

Apache Airflow operating system command injection vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow Spark Provider versions prior to 4.0.0...

org.apache.hama:hama-examples (>=0.4.0-incubating, <=0.7.1), org.apache.hama:hama-graph (>=0.4.0-incubating, <=0.7.1) +3 more potentially affected by CVE-2022-45470 via org.apache.hama:hama-core (>=0.4.0-incubating, <=0.7.1)

org.apache.hama:hama-core MAVEN version =0.4.0-incubating, =0.4.0-incubating, =0.4.0-incubating, =0.7.0, =0.5.0, =0.7.0, =0.7.1 Source cves: CVE-2022-45470 Source advisory: GHSA-4WFH-48V4-3R84...

foreman: foreman: OAuth secret exposure via unauthenticated access to the GraphQL API

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API...

org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2022-45379 via org.jenkins-ci.plugins:script-security (1.34)

org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...

org.apache.archiva:archiva-configuration (1.2.2), org.apache.archiva:archiva-consumer-api (1.2.2) +11 more potentially affected by CVE-2022-40308 via org.apache.archiva:archiva-common (1.2.2)

org.apache.archiva:archiva-common MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.archiva:archiva-common and may be impacted: - org.apache.archiva:archiva-configuration 1.2.2 - org.apache.archiva:archiva-consumer-api 1.2....

org.apache.archiva:archiva-configuration (1.1.4), org.apache.archiva:archiva-consumer-api (1.1.4) +10 more potentially affected by CVE-2022-40308 via org.apache.archiva:archiva-common (1.1.4)

org.apache.archiva:archiva-common MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.archiva:archiva-common and may be impacted: - org.apache.archiva:archiva-configuration 1.1.4 - org.apache.archiva:archiva-consumer-api 1.1....

org.apache.archiva:archiva-configuration (1.1.3), org.apache.archiva:archiva-consumer-api (1.1.3) +10 more potentially affected by CVE-2022-40309 via org.apache.archiva:archiva-common (1.1.3)

org.apache.archiva:archiva-common MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.archiva:archiva-common and may be impacted: - org.apache.archiva:archiva-configuration 1.1.3 - org.apache.archiva:archiva-consumer-api 1.1....

org.apache.archiva:archiva-configuration (1.2-m1), org.apache.archiva:archiva-consumer-api (1.2-m1) +13 more potentially affected by CVE-2022-40309 via org.apache.archiva:archiva-common (1.2-m1)

org.apache.archiva:archiva-common MAVEN version 1.2-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.archiva:archiva-common and may be impacted: - org.apache.archiva:archiva-configuration 1.2-m1 - org.apache.archiva:archiva-consumer-api...

Wiz and Google Cloud’s Security Command Center: Modern threat detection and response rooted in risk prioritization

Fully understand the impact and architecture behind any threat to streamline and speed effective response with a first-of-its-kind integration combining the Wiz Security Graph’s deep cloud and multi-cloud risk context with Google Cloud’s Security Command Center’s advanced threat detection...

PT-2022-35070 · Xilinx · Xilinx Vipp

Name of the Vulnerable Software and Affected Versions: Xilinx VIPP versions prior to v6.0.3 Description: A refcount leak was discovered in the xvip graph dma init function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in Linux Kernel version v4.1 a...

PT-2022-35526

Name of the Vulnerable Software and Affected Versions Xilinx VIPP versions prior to v5.10.150 Description A refcount leak was discovered in the xvip graph dma init function. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to v5.10.150, update...

PT-2022-35327

Name of the Vulnerable Software and Affected Versions Xilinx VIPP versions prior to v5.15.75 Description A refcount leak was discovered in the xvip graph dma init function. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to v5.15.75, update t...

PT-2022-35662

Name of the Vulnerable Software and Affected Versions Xilinx VIPP versions prior to v5.4.220 Description A refcount leak was discovered in the xvip graph dma init function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v4.1 and is fixed i...