Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates in the qfqchangeagg function in net/sched/schqfq.c that allows out-of-bounds writes. An attacker could explo...

Security Bulletin: IBM Workload Scheduler is potentially affected by multiple vulnerabilities in OpenSSL (CVE-2022-4304, CVE-2023-0215, CVE-2023-0286)

Summary IBM Workload Scheduler is potentially affected by Denial of Service and information disclosure attacks due to vulnerabilities found in OpenSSL Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a...

WordPress Menu Item Scheduler Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Menu Item Scheduler Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 85b80b505402 Credits Rafie Muhammad Patchstack Required...

WordPress Cleanup Action Scheduler Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Cleanup Action Scheduler Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 658cd4ed1a2b Credits Rafie Muhammad Patchsta...

WordPress Content Scheduler: Editorial Calendar and Notes Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Content Scheduler: Editorial Calendar and Notes Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bce889e4798c Credits...

CVE-2023-37272

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272

Summary (CVE-2023-37272) : The JOC Cockpit component of JobScheduler (JS7) is affected by a cross-site scripting (XSS) vulnerability that arises when users upload files containing user-generated documents and specify filenames crafted to inject code executed in the browser. The issue is present i...

CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-22888 Apache Airflow: Scheduler remote DoS

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the runid parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version th...

Use-After-Free

cups is vulnerable to Use-After-Free. The vulnerability occurs when the httpClosecon-http function is called within scheduler/client.c. CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before leading to...

ALPINE-CVE-2023-34241

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...

AZL-37099 CVE-2023-34241 affecting package cups for versions less than 2.4.10-1

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...

CVE-2023-34241 CUPS vulnerable to use-after-free in cupsdAcceptClient()

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data...

OpenPrinting CUPS 资源管理错误漏洞

OpenPrinting CUPS is a standards-based open source printing system for Linux® and other Unix®-like operating systems from OpenPrinting, Inc. A resource management error vulnerability exists in OpenPrinting CUPS versions 2.2.0 through 2.4.6, which stems from a call to the httpClosecon-http functio...

LSN-0095-1: Kernel Live Patch Security Notice

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.CVE-2023-0386 It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel...

USN-6173-1: Linux kernel (OEM) vulnerabilities

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-31436 It was discovered that the...

RLSA-2023:3350 Important: kernel-rt security and bug fix update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: netfilter: use-after-free in nftables when processing batch requests can lead to privilege escalation CVE-2023-32233 For more...

kernel-rt security and bug fix update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

Security Bulletin: IBM Workload Scheduler potentially affected by a vulnerability in SnakeYaml (CVE-2022-1471)

Summary IBM Workload Scheduler is potentially affected by a vulnerability found in SnakeYaml that can cause a remote code execution attack while deserializing yaml content. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote authenticated attacker to execute...