gzip: arbitrary-file-write vulnerability

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation...

CVE-2022-26944

Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONASCHEMA.xtrabackuphistory table. NOTE:...

Design/Logic Flaw

Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONASCHEMA.xtrabackuphistory table. NOTE:...

CVE-2022-26944

Percona XtraBackup 2.4.20 is affected by CVE-2022-26944 and CVE-2020-10997 due to an information exposure: the command line and runtime arguments are written to backup outputs and, when --history is used, to the PERCONA_SCHEMA.xtrabackup_history table. The issue stems from an incomplete fix for C...

CVE-2022-30512

School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/paymenthistory.php:31...

USN-5458-1: Vim vulnerabilities

It was discovered that Vim was incorrectly handling virtual column position operations, which could result in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive information. CVE-2021-4193 It was discovered that Vim was not properly performing bounds checks when...

OESA-2022-1692 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache...

Information Disclosure

convert2rhel is vulnerable to information disclosure. The vulnerability exists when the library passes the red hat account password to the subscription manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via...

Percona XtraBackup 安全漏洞

Percona XtraBackup is an open source hot backup utility for MySQL databases from Percona USA. A security vulnerability exists in Percona XtraBackup version 2.4.20, which stems from Percona XtraBackup 2.4.20 inadvertently writing a command line to any generated backup file...

The vulnerability of the CLI component of Cisco SD-WAN microprogramming software allows a hacker to enhance their privileges.

The vulnerability of the CLI component of Cisco SD-WAN microprogramming software is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges by modifying certain files on the vulnerable device...

Debian DSA-5153-1 : trafficserver - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5153 advisory. Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in HTTP request smuggling or MITM...

CLSA-2022-1653933185 Fixed CVEs in vim: CVE-2022-1735, CVE-2022-1733

CVE-2022-1733: fix reading past end of the line when C-indenting - CVE-2022-1735: fix invalid memory access caused by changing text in Visual mode...

The vulnerability of the command-line interface of Cisco Firepower Threat Defense (FTD) software allows a hacker to execute arbitrary code.

The vulnerability of the command-line interface of Cisco Firepower Threat Defense FTD software relates to errors in processing XML requests. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created XML data...

Ransomware-Simulator - Ransomware Simulator Written In Golang

The goal of this repository is to provide a simple, harmless way to check your AV's protection on ransomware. This tool simulates typical ransomware behaviour, such as: Staging from a Word document macro Deleting Volume Shadow Copies Encrypting documents embedded and dropped by the simulator into...

The vulnerability of the command-line interface of FortiWeb web applications allows attackers to disclose protected information.

The vulnerability of the command-line interface of FortiWeb web applications is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information using debugging commands...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2022-1711)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this wa...

CLSA-2022-1653499822 Fix CVE(s): CVE-2022-0318

SECURITY UPDATE: Reading beyond the end of a line - debian/patches/CVE-2022-0318.patch: For block insert only use the offset for correcting the length, adjust expected output of the relevant UTF8 block insertion test - CVE-2022-0318...

GHSA-4MGV-M5CM-F9H7 Vault GitHub Action did not correctly mask multi-line secrets in output

HashiCorp vault-action aka Vault GitHub Action before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. The vault-action implementation did not correctly handle the marking of...

GHSA-6CWM-WM82-HGRW MongoDB Tools Improper Certificate Validation vulnerability

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...

MongoDB Tools Improper Certificate Validation vulnerability

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...