PT-2022-28495

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.99 Description The issue is related to the ASoC: ops, where out of bounds values in snd soc put xr sx are not properly rejected. The actual impact and attack plausibility have not yet been proven...

PT-2022-28414

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.228 Description The issue is related to the ASoC: ops, where out of bounds values in snd soc put volsw sx are not properly rejected. The actual impact and attack plausibility have not yet been proven...

PT-2022-28411

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.228 Description The issue is related to the rtnetlink component in the Linux Kernel, specifically with the rtnl newlink function. It involves a potential problem with refreshing master dev/m ops. The actual...

PT-2022-28538

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.19 Description The issue concerns the use of mm ops indirection for cache maintenance in the KVM arm64 pkvm. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-28490

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.97 Description The issue is related to the rtnetlink component, specifically in the rtnl newlink function, where it fails to refresh master dev/m ops. The actual impact and attack plausibility have not yet...

PT-2022-28385

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.265 Description The issue is related to the rtnetlink component, specifically in the rtnl newlink function, where it fails to refresh master dev/m ops. The actual impact and attack plausibility have not yet...

PT-2022-28443

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.14 through 5.4.176 Description The issue is related to the rtnetlink component, specifically in the rtnl newlink function, where it fails to refresh master dev/m ops. The actual impact and attack plausibility have not y...

`CHECK`-failures in binary ops in Tensorflow

Impact A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer matches the dtype expected by the op. In that cas...

Server-Side Request Forgery in Apache Traffic Control

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

GHSA-WP47-9R3H-XFGQ Server-Side Request Forgery in Apache Traffic Control

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Server-Side Request Forgery (SSRF)

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Design/Logic Flaw

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206

This CVE concerns Apache Traffic Control Traffic Ops. An unprivileged user reachable over HTTPS could send a crafted POST to /user/login/oauth, enabling SSRF to scan a server port within Traffic Ops reach. Affected are Traffic Ops prior to 6.1.0 or 5.1.6. Impact is described as port-scanning capa...

CVE-2022-23206

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

PT-2022-15905 · Apache · Apache Traffic Control Traffic Ops

Name of the Vulnerable Software and Affected Versions: Apache Traffic Control Traffic Ops versions prior to 6.1.0 Apache Traffic Control Traffic Ops versions prior to 5.1.6 Description: The issue allows an unprivileged user who can reach Traffic Ops over HTTPS to send a specially-crafted POST...

Server-Side Request Forgery (SSRF)

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...