MAL-2025-3303 Malicious code in @sas-dvr/internal-va-react-core (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @sas-dvr/internal-va-react-core (npm)

--- -= Per source details. Do not edit below this line.=-...

ZDI-23-1527 and ZDI-23-1528: The Potential Impact of Overly Permissive SAS Tokens on PC Manager Supply Chains

In ZDI-23-1527 and ZDI-23-1528 we uncover two possible scenarios where attackers could have compromised the Microsoft PC Manager supply chain...

hisi_sas_internal_abort_timeout Heap Buffer Overflow DoS

Vulnerability of the hisisasinternalaborttimeout function in the drivers/scsi/hisisas/hisisasmain.c module – The Linux SCSI device support driver is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Security update for the Linux Kernel (Live Patch 60 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122228 fixes one issue. The following security issue was fixed: CVE-2022-48791: Fix use-after-free for aborted TMF sastask bsc1228002 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for the Linux Kernel (Live Patch 59 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122225 fixes several issues. The following security issues were fixed: CVE-2024-41062: Sync sock recv cb and release bsc1228578. CVE-2022-48791: Fix use-after-free for aborted TMF sastask bsc1228002 Patch Instructions: To install this SUSE update use the...

Malicious code in @sas-dvr/ltjs-vav (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f112f9f091de3ef1cc3a38c7a9cbb0bccc1949f7e38f8bb633cf9d5a06c646d7 The OpenSSF Package Analysis project identified '@sas-dvr/ltjs-vav' @ 132.0.0 npm as malicious. It is considered malicious because: - The packag...

Malicious code in @sas-dvr/ltjs-bird (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bed916c128062e6e46a4741aecf296a1d3898ba06f3f0a818b19c8e90cd69f5b The OpenSSF Package Analysis project identified '@sas-dvr/ltjs-bird' @ 132.0.0 npm as malicious. It is considered malicious because: - The packa...

Malicious code in @sas-dvr/nova-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ee49dd296a0db13b0118e5424d00aac99ea70cc3664bba504af096916e31998 The OpenSSF Package Analysis project identified '@sas-dvr/nova-graph' @ 132.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in @sas-dvr/ltjs-gtl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 590d9654b9fef2a4c23a65543bd772d8aa4c0b3262912a102d66720d6cd50b78 The OpenSSF Package Analysis project identified '@sas-dvr/ltjs-gtl' @ 132.0.0 npm as malicious. It is considered malicious because: - The packag...

CVE-2025-1434 XSS in AREAL SAS Topkapi Vision Webserv2

The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected...

CVE-2025-1434 XSS in AREAL SAS Topkapi Vision Webserv2

The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected...

kernel: scsi: megaraid_sas: Fix for a potential deadlock

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Fix for a potential deadlock This fixes a 'possible circular locking dependency detected' warning CPU0 CPU1 ---- ---- lock&instance-resetmutex; lock&shost-scanmutex; lock&instance-resetmutex;...

scsi: megaraid_sas: Fix for a potential deadlock

...

Confluence Migrator Application information leakage vulnerability

Confluence Migrator Application is an open source migrator application from XWiki SAS. An information disclosure vulnerability exists in Confluence Migrator Application versions prior to 1.11.7. An attacker can exploit this vulnerability to obtain sensitive information...

SUSE CVE-2022-49118

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Free irq vectors in order for v3 HW If the driver probe fails to request the channel IRQ or fatal IRQ, the driver will free the IRQ vectors before freeing the IRQs in freeirq, and this will cause a kernel BUG like...

CVE-2022-49120

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix task leak in pm8001sendabortall In pm8001sendabortall, make sure to free the allocated sas task if pm8001tagalloc or pm8001mpibuildcmd fail...

DEBIAN-CVE-2022-49118

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Free irq vectors in order for v3 HW If the driver probe fails to request the channel IRQ or fatal IRQ, the driver will free the IRQ vectors before freeing the IRQs in freeirq, and this will cause a kernel BUG like...

CVE-2022-49120 scsi: pm8001: Fix task leak in pm8001_send_abort_all()

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix task leak in pm8001sendabortall In pm8001sendabortall, make sure to free the allocated sas task if pm8001tagalloc or pm8001mpibuildcmd fail...

CVE-2022-49120

CVE-2022-49120 pertains to the Linux kernel SCSI pm8001 path. The vulnerability is a task leak in pm8001_send_abort_all() where allocated SAS tasks may not be freed if pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail. The fix ensures proper freeing of the SAS task in those failure paths. Public ...