AZL-9917 CVE-2022-1998 affecting package kernel for versions less than 5.15.48.1-2

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copyinforecordstouser call to fail in copyeventtouser. A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

CVE-2022-1998

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copyinforecordstouser call to fail in copyeventtouser. A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

CVE-2022-1998

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copyinforecordstouser call to fail in copyeventtouser. A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

Bribe Rewards Not Collected In Current Period Will Be Lost Forever

Lines of code Vulnerability details High Bribe Rewards Not Collected In Current Period Will Be Lost Forever Vulnerability Details It was observed that if the bribe rewards are not collected in the current period, they will not be accrued to future epoch, and they will be lost forever...

GHSA-8P4M-62GP-33J4 Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin

Pipeline GitHub Notify Step Plugin 1.0.4 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid...

CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials

A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

GHSA-QHXF-M7JM-JC57 CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials

A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin

Pipeline GitHub Notify Step Plugin 1.0.4 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid...

GHSA-5H29-QQ92-WJ7F Cleartext Transmission of Sensitive Information in Apache MINA

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

OESA-2022-1660 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Insufficient control flow management for the IntelR 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access.CVE-2021-33061 A use after free in the Linux...

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

WordPress Ad Blocker Notify Lite plugin <= 2.4.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ad Blocker Notify Lite plugin versions = 2.4.0. Solution No patched version available...

WordPress Ad Blocker Notify Lite plugin <= 2.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ad Blocker Notify Lite plugin versions = 2.4.0. Solution No patched version available...

Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify

The qualitycustomizernotifydismissaction and ticustomizernotifydismissrecommendedplugins AJAX actions names can differ depending on the theme, available to authenticated users in multiple themes do not validate or escape the id parameter before outputting it back in the response, leading to...

Multiple Themes - Reflected Cross-Site Scripting via Customizer Notify

The qualitycustomizernotifydismissaction and ticustomizernotifydismissrecommendedplugins AJAX actions names can differ depending on the theme, available to authenticated users in multiple themes do not validate or escape the id parameter before outputting it back in the response, leading to...

CLSA-2022-1643727522 Fix of CVE: CVE-2021-35942, CVE-2021-27645, CVE-2021-33574

CVE-2021-27645: nscd: Fix double free in netgroupcache 1927877 - CVE-2021-33574: Deep copy pthread attribute in mqnotify 1966472 - CVE-2021-35942: wordexp: handle overflow in positional parameter number 1979127 - librt: fix NULL pointer dereference 1966472...

CVE-2021-46118

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...