10332 matches found
[SECURITY] Fedora 34 Update: systemd-248.10-1.fc34
systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...
Polkit pkexec privilege elevation
Added: 01/27/2022 CVE: CVE-2021-4034 Background Polkit is a Linux package for handling policies that allow unprivileged processes to communicate with privileged processes. It includes a tool called pkexec that allows the user to execute commands as another user according to the polkit policy...
OESA-2022-1494 libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...
SUSE-SU-2022:0135-1 Security update for busybox
This update for busybox fixes the following issues: - CVE-2011-5325: Fixed tar directory traversal bsc951562. - CVE-2015-9261: Fixed segfalts and application crashes in huftbuild bsc1102912. - CVE-2016-2147: Fixed out of bounds write heap due to integer underflow in udhcpc bsc970663. -...
Open-Source Security: Getting to the Root of the Problem
The past few weeks have shown us the importance and wide reach of open-source security. In December 2021, public disclosure of the Log4Shell vulnerability in Log4j, an open-source logging library, caused a cascade of dependency analysis by developers in organizations around the world. The inciden...
Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file
...
Information Disclosure
python-django is vulnerable to information disclosure. The vulnerability exist due to the lack of sanitizaton of the Template Language's variable resolution logic...
Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...
GHSA-85RQ-HP8X-GHJQ Cross-Site Request Forgery in Jenkins Mailer Plugin
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...
GHSA-558X-H7RG-997V Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...
CVE-2022-20614
A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-20613
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-20613
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
GHSA-8C5J-9R9F-C6W8 Information disclosure in Django
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...
CVE-2022-0012
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service condition. This issue impacts: Cortex XDR age...
CVE-2022-20614
A missing permission check in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...
CVE-2022-0012: Improper Link Resolution Before File Access
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service condition. This issue impacts: Cortex XDR age...
PT-2022-12949
Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XDR agent versions prior to 5.0.12 Palo Alto Networks Cortex XDR agent versions prior to 6.1.9 Palo Alto Networks Cortex XDR agent versions prior to 7.2.4 Palo Alto Networks Cortex XDR agent versions prior to 7.3.2...
CVE-2022-20613: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF vulnerability in Jenkins Mailer Plugin 391.ve4a38c1bcf4b and earlier allows attackers to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname...