PT-2022-32797

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.134 Description The issue concerns a data-race around sysctl tcp min snd mss in the tcp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-32613

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.58 Description The issue concerns a data-race condition around the sysctl tcp min snd mss setting in the TCP implementation. The actual impact and potential for attack have not been fully determined...

PT-2022-32391

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.15 Description The issue concerns a data-race condition around the sysctl tcp min snd mss setting in the TCP implementation. This condition may potentially lead to security vulnerabilities, although the...

PT-2022-32941

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.208 Description The issue concerns a data-race around sysctl tcp min snd mss in the tcp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2025-8591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to insufficient bounds propagation in the Linux kernel's bpf Berkeley Packet Filter functionality. Specifically, it concerns the adjust scalar min max vals function,...

CVE-2021-33648

When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers...

Huawei MindSpore Community 缓冲区错误漏洞

Huawei MindSpore Community is an open source deep learning framework from Huawei, China. Huawei MindSpore Community suffers from an information disclosure vulnerability that stems from accessing a shape allocated from the heap buffer if the input shape size is 0 when performing inferred shape...

CVE-2022-31025

CVE-2022-31025 affects Discourse; prior to versions 2.8.4 (stable) and 2.9.0beta5 (beta/tests-passed) an SSO-based invite could bypass must_approve_users, causing invites by staff to be auto-approved. A fix is available: Discourse 2.8.4 on stable and 2.9.0.beta5 on beta/tests-passed. Workarounds ...

OESA-2022-1581 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

DEBIAN-CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

Memory corruption

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

CVE-2021-21708 UAF due to php_filter_float() failing

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

Attacker may DDOS Withdrawal by Making Multiple Small Requests to withdraw()

Lines of code Vulnerability details Impact 1. Attacker call function withdraw with lowest amount eg. 1 0.000001 VUSD 2. The withdrawal request will go into waiting list in variable "withdrawals" 3. Attacker can repeat Step 1 & 2 to make Making Multiple Small Requests to withdraw until pending...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: OSV:GHSA-2M53-83F3-562J...

GHSA-2M53-83F3-562J Prototype pollution in min-dash

Impact The set method is vulnerable to prototype pollution with specially crafted inputs. javascript // insert the following into poc.js and run node poc,js after installing the package let parser = require"min-dash"; parser.set, "proto", "polluted", "success"; console.logpolluted; Patches...

Prototype pollution in min-dash

Impact The set method is vulnerable to prototype pollution with specially crafted inputs. javascript // insert the following into poc.js and run node poc,js after installing the package let parser = require"min-dash"; parser.set, "proto", "polluted", "success"; console.logpolluted; Patches...

GHSA-FM93-FHH2-CG2C Duplicate Advisory: Prototype Pollution in min-dash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references. Original Description The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement...