[SECURITY] Fedora 36 Update: pack-0.29.0~rc1-1.fc36

pack is a CLI implementation of the Platform Interface Specification for Cloud Native Buildpacks...

USN-5962-1 linux-intel-iotg vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

.NET 7.0 bugfix update

An update is available for dotnet7.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...

Authentication Bypass

codeigniter4/shield is vulnerable to Authentication Bypass. The vulnerability exists due to a weak implementation of the password storage functionality which allows an attacker to crack the password if they have access to a user's hashed password...

Current transfer implementations can lead to loss of user founds if LP is updated or wrongly set

Lines of code Vulnerability details Current transfer implementations can lead to loss of user founds if LP is updated or wrongly set The current implementation of assetTransfer and assetTransferFrom don't check if the asset is a contract and don't check if the transfer returns a false instead of...

The vulnerability in the implementation of the PAPI network protocol for ArubaOS operating systems allows a hacker to execute arbitrary code.

The vulnerability of the PAPI network protocol implementation in ArubaOS operating systems lies in the fact that operations are performed outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted packets...

USN-5951-1: Linux kernel (IBM) vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

PaperCut NG SecurityRequestFilter Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the...

Password Shucking Vulnerability

Impact An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets 1 the user's hashed...

GHSA-C5VJ-F36Q-P9VG Password Shucking Vulnerability

Impact An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets 1 the user's hashed...

Exploit for Code Injection in Vmware Spring_Cloud_Function

CVE-2022-22963: Spring4Shell RCE Exploit This is a python im...

Chromium: CVE-2023-1229 Inappropriate implementation in Permission prompts

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2023-1236 Inappropriate implementation in Internals

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

[SECURITY] Fedora 38 Update: rust-sequoia-sop-0.26.1-5.fc38

Implementation of the Stateless OpenPGP Interface using Sequoia...

MerkleMinter created through TokenFactory cannot be upgraded

Lines of code Vulnerability details Impact During the token creation process in the TokenFactory contract, the function creates a MerkleMinter contract to setup and handle token initial token distribution. ... // Clone and initialize a MerkleMinter address merkleMinter = merkleMinterBase.clone;...

CVE-2023-1205

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly implemented CSRF protections...

INITIALIZE FUNCTION IN COUNTERV2.SOL CAN BE INVOKED MULTIPLE TIMES FROM THE IMPLEMENTATION CONTRACT

Lines of code Vulnerability details Impact Initialize function in CounterV2.sol can be invoked multiple times from the implementation contract. This means a compromised implementation can reinitialize the contract above. Usually in Upgradeable contract, an initialize function is protected by the...

USN-5941-1: Linux kernel (KVM) vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

Google Chrome Security Updates (stable-channel-update-for-desktop-2023-03) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Ubuntu: Security Advisory (USN-5939-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...