UBUNTU-CVE-2022-50045

In the Linux kernel, the following vulnerability has been resolved: powerpc/pci: Fix getphbnumber locking The recent change to getphbnumber causes a DEBUGATOMICSLEEP warning on some systems: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 inatomic: 1, irqsdisabled...

HashiCorp Nomad Enterprise和HashiCorp Nomad Community 安全漏洞

HashiCorp Nomad Enterprise and HashiCorp Nomad Community are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Nomad Enterprise is a professional version of the Nomad software.HashiCorp Nomad Community is HashiCorp Nomad Community is a workload scheduler. A security vulnerability exists in...

CVE-2023-23011

Cross Site Scripting XSS vulnerability in InvoicePlane 1.6 via filterproduct input to file modalproductlookups.php...

CVE-2023-27894

SAP BusinessObjects Business Intelligence Platform Web Services - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal...

CVE-2022-22364

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrar...

SUSE CVE-2025-37894

In the Linux kernel, the following vulnerability has been resolved: net: use sockgenput when skstate is TCPTIMEWAIT It is possible for a pointer of type struct inettimewaitsock to be returned from the functions inetlookupestablished and inet6lookupestablished. This can cause a crash when the...

SUSE CVE-2025-37790

In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCKRCUFREE Bind lookup runs under RCU, so ensure that a socket doesn't go away in the middle of a lookup...

CVE-2022-49899 fscrypt: stop using keyrings subsystem for fscrypt_master_key

In the Linux kernel, the following vulnerability has been resolved: fscrypt: stop using keyrings subsystem for fscryptmasterkey The approach of fs/crypto/ internally managing the fscryptmasterkey structs as the payloads of "struct key" objects contained in a "struct key" keyring has outlived its...

CVE-2023-52934

In the Linux kernel, the following vulnerability has been resolved: mm/MADVCOLLAPSE: catch !none !huge !bad pmd lookups In commit 34488399fa08 "mm/madvise: add file and shmem support to MADVCOLLAPSE" we make the following change to findpmdorthpornone: - if !pmdpresentpmde - return SCANPMDNULL; + ...

CVE-2023-52934

CVE-2023-52934 refers to a Linux kernel MADV_COLLAPSE issue. A change in MADV_COLLAPSE handling of pmd lookups (replacing a !pmd_present check with pmd_none) aims to distinguish none-pmd cases from absent/bad-pmd cases to prevent misclassifying swap or other entries as huge-pmd mappings. The prov...

CVE-2023-52934 mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups

In the Linux kernel, the following vulnerability has been resolved: mm/MADVCOLLAPSE: catch !none !huge !bad pmd lookups In commit 34488399fa08 "mm/madvise: add file and shmem support to MADVCOLLAPSE" we make the following change to findpmdorthpornone: - if !pmdpresentpmde - return SCANPMDNULL; + ...

CVE-2023-43052 IBM Control Center external service interaction

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

CVE-2023-43052 IBM Control Center external service interaction

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domai...

SUSE CVE-2022-49697

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-24818

GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case,...

PT-2025-37962

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6 Description The Linux kernel contains a flaw in the efivarfs module related to an out-of-bounds write in the efivarfs d compare function. This issue occurs when dentry-d name.len is less than EFI VARIABLE GUI...

USN-7136-1 python-django vulnerabilities

jiangniao discovered that Django incorrectly handled the API to strip tags. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. CVE-2024-53907 Seokchan Yoon discovered that Django incorrectly handled HasKey lookups when using Oracl...

GHSA-PCX7-8HXG-J823 Duplicate Advisory: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jgwc-jh89-rpgq. This link is maintained to preserve external references. Original Description A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service DoS attack...

Fedora 37 : java-1.8.0-openjdk (2022-dedbb92a08)

"The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-dedbb92a08 advisory. New in release OpenJDK 8u352 2022-10-18 Release announcement Full release notes Security Fixes JDK-8282252: Improve BigInteger/Decimal validation...

The vulnerability of the External Lookups technology in the Splunk Enterprise platform for operational analysis allows a malicious actor to escalate their privileges and execute arbitrary commands.

The vulnerability of Splunk Enterprise’s External Lookups technology relates to the improper elimination of certain elements used in the operating system’s command set. This occurs due to the use of data models for detecting unauthorized searches called SearchActivity. Exploiting this vulnerabili...