6540 matches found
CVE-2022-23541 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
jsonwebtoken is an implementation of JSON Web Tokens. Versions = 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There i...
CVE-2022-3910 affecting package kernel for versions less than 5.15.82.1-1
CVE-2022-3910 affecting package kernel for versions less than 5.15.82.1-1. A patched version of the package is available...
CVE-2022-41849 affecting package kernel for versions less than 5.15.82.1-1
CVE-2022-41849 affecting package kernel for versions less than 5.15.82.1-1. A patched version of the package is available...
CVE-2022-2785 affecting package kernel for versions less than 5.15.82.1-1
CVE-2022-2785 affecting package kernel for versions less than 5.15.82.1-1. A patched version of the package is available...
CVE-2022-3344 affecting package kernel for versions less than 5.15.82.1-1
CVE-2022-3344 affecting package kernel for versions less than 5.15.82.1-1. A patched version of the package is available...
CVE-2022-37454 affecting package python3 for versions less than 3.9.14-5
CVE-2022-37454 affecting package python3 for versions less than 3.9.14-5. A patched version of the package is available...
CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package
GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine...
CVE-2022-41964 BigBlueButton contains Response leaks in anonymous polls
BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll...
PT-2022-14724 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android version Android-13 Description: A missing permission check in the getNearbyAppStreamingPolicy function of DevicePolicyManagerService.java could lead to local information disclosure without requiring additional execution privileges. Us...
CVE-2022-23518
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions = 1.0.3, = 2.1.0. This issue is patched in version 1.4.4...
CVE-2022-23518 Improper neutralization of data URIs allows XSS in rails-html-sanitizer
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions = 1.0.3, = 2.1.0. This issue is patched in version 1.4.4...
CVE-2022-23515
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.1.0, 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1...
Design/Logic Flaw
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
PYSEC-2022-43011
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
CVE-2022-23485 Invite code reuse via cookie manipulation in sentry
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
CVE-2022-23485 Invite code reuse via cookie manipulation in sentry
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
CVE-2022-3821 affecting package systemd for versions less than 250.3-10
CVE-2022-3821 affecting package systemd for versions less than 250.3-10. A patched version of the package is available...
CVE-2022-40768 affecting package kernel 5.10.153.1-1
CVE-2022-40768 affecting package kernel 5.10.153.1-1. A patched version of the package is available...