PT-2022-9029 · Openmrs · Openmrs Appointment Scheduling Module

Name of the Vulnerable Software and Affected Versions: OpenMRS Appointment Scheduling Module versions up to 1.12.x Description: A problematic issue has been found, affecting the validateFieldName function of the AppointmentTypeValidator.java file. This leads to cross-site scripting and can be...

OpenMRS 跨站脚本漏洞

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A cross-site scripting vulnerability exists in versions prior to OpenMRS Appointment Scheduling Module 1.12.x. The vulnerability can be exploited to perform cross-site scripting attacks. An attacke...

CVE-2022-4727 OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting

A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation...

PT-2022-28041 · Openmrs · Openmrs Appointment Scheduling Module

Name of the Vulnerable Software and Affected Versions: OpenMRS Appointment Scheduling Module versions up to 1.16.x Description: A vulnerability was found in the OpenMRS Appointment Scheduling Module, affecting the function getNotes of the file...

CVE-2022-4727 OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting

A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation...

CVE-2022-4727

The CVE-2022-4727 entry concerns OpenMRS Appointment Scheduling Module (versions up to 1.16.x). The vulnerability lies in the getNotes function of AppointmentRequest.java (Notes Handler), where manipulating the notes argument enables cross-site scripting. It can be triggered remotely. A fix is av...

GSD-2022-1008365 net: sched: Fix use after free in red_enqueue()

net: sched: Fix use after free in redenqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.333 by commit...

GSD-2022-1007855 net: sched: Fix use after free in red_enqueue()

net: sched: Fix use after free in redenqueue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.8 by commit...

spacewalk-backend spacewalk-java security update

spacewalk-backend 2.10.28-1.0.13 - Fix HTTP 500 and ORA-01830 on client scap report Orabug: 34823889 2.10.28-1.0.12 - Handle remote commands that return no output. Orabug: 32530545 2.10.28-1.0.11 - Make spacewalk-debug copy symlink target instead of the symlink itself. Orabug: 32514543...

XXL-JOB code issue vulnerability

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xueli XXL-JOB community.A security vulnerability exists in versions prior to XXL-JOB v2.3.1, which stems from a vulnerability found via the component /admin/controller/JobLogController.java containing...

kernel: arch/arm64: Fix topology initialization for core scheduling

In the Linux kernel, the following vulnerability has been resolved: arch/arm64: Fix topology initialization for core scheduling Arm64 systems rely on storecputopology to call updatesiblingsmasks to transfer the toplogy to the various cpu masks. This needs to be done before the call to...

kernel: Revert "Revert "block, bfq: honor already-setup queue merges""

In the Linux kernel, the following vulnerability has been resolved: Revert "Revert "block, bfq: honor already-setup queue merges"" A crash 1 happened to be triggered in conjunction with commit 2d52c58b9c9b "block, bfq: honor already-setup queue merges". The latter was then reverted by commit...

kernel: scsi: qla2xxx: Fix scheduling while atomic

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix scheduling while atomic The driver makes a call into midlayer fcremoteportdelete which can put the thread to sleep. The thread that originates the call is in interrupt context. The combination of the two trigge...

kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c

A use-after-free flaw was found in u32change in net/sched/clsu32.c in the network subcomponent of the Linux kernel. This flaw allows a local attacker to crash the system, cause a privilege escalation, and leak kernel information...

GSD-2022-1006677 net: sched: cake: fix null pointer access issue when cake_init() fails

net: sched: cake: fix null pointer access issue when cakeinit fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.6 by commit...

kernel: scsi: qla2xxx: Fix scheduling while atomic

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix scheduling while atomic The driver makes a call into midlayer fcremoteportdelete which can put the thread to sleep. The thread that originates the call is in interrupt context. The combination of the two trigge...

Apache DolphinScheduler Path Traversal Vulnerability (CNVD-2022-78865)

Apache DolphinScheduler, a distributed DAG visualization-based workflow task scheduling system from the Apache Foundation, is vulnerable to a path traversal vulnerability in versions prior to Apache DolphinScheduler 3.0.0, which stems from a path traversal when a user adds a resource to the...

CVE-2022-40202

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication...

CVE-2022-40202

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide malicious serialized objects which, when deserialized, could activate an opcode for a backup scheduling function without authentication...

PT-2022-25280 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The database backup function in the software lacks proper authentication, allowing an attacker to provide malicious serialized objects. When deserialized,...