PT-2022-29156

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.182 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

PT-2022-29201

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.269 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

PT-2022-29123

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.11 through 5.10.102 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

PT-2022-29220

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.304 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

PT-2022-29069

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.26 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

PT-2022-29001

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.12 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

PT-2022-29181

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.232 Description The issue is related to the xhci component, where futile URB re-submissions occur due to an incorrect return value. The actual impact and attack plausibility have not yet been proven...

JFrog Artifactory 安全漏洞

JFrog Artifactory is an open source general-purpose Artifact repository manager from Israel-based JFrog Jfrog that supports clustering and high-availability Docker registries and provides an end-to-end automation solution for tracking artifacts from development to production.JFrog Artifactory...

Default configuration

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...

CVE-2022-21654 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...

CVE-2022-21654 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...

CVE-2022-21654

CVE-2022-21654 affects Envoy (open‑source edge/service proxy). The issue stems from TLS: session re‑use is possible when cert validation settings have been changed from defaults. The stated workaround is to ensure default TLS settings are used, and users are advised to upgrade for remediation.

GO-2022-0425 Weak encryption and denial of service in github.com/flynn/noise

The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 18.4 quintillion messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to b...

GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...

Use of a Broken or Risky Cryptographic Algorithm

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

GHSA-WQFH-9M4G-7X6X Remote code execution in Apache ActiveMQ

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a...

Potential Re-entrancy Attack via ETH or ERC777 Token Transfer

Lines of code Vulnerability details Impact The CEI pattern is not being implemented properly in the claimRewards function of the ConcurRewardPool.sol. function claimRewardsaddress calldata tokens external override for uint256 i = 0; i tokens.length; i++ uint256 getting = rewardmsg.sendertokensi;...

Re-entrancy vulnerabilities

Lines of code Vulnerability details Impact Function claimRewards in ConcurRewardPool should be re-entrancy protected or first nullify the reward before sending it, otherwise, if any token contains a transfer callback hook, users can claim the same rewards multiple times, by re-entering the functi...

GHSA-CH68-7CF4-35VR Limited ability to spoof SAML authentication with missing audience verification in Fleet

Impact This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, and the user signs into the malicious SP via SAML SSO...

CVE-2021-28503

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI...