753 matches found
GSD-2022-1004944 usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
usb: gadget: lpc32xxudc: Fix refcount leak in lpc32xxudcprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.320 by commit...
GSD-2022-1004531 net: stmmac: fix dma queue left shift overflow issue
net: stmmac: fix dma queue left shift overflow issue This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.134 by commit...
SUSE-SU-2022:2354-1 Security update for freerdp
This update for freerdp fixes the following issues: - CVE-2022-24882: Fixed incorrect check parameters in NTLM bsc1198919. - CVE-2022-24883: Fixed authentication against invalid SAM files bsc1198921...
GSD-2022-1004030 usb: dwc2: gadget: don't reset gadget's driver->bus
usb: dwc2: gadget: don't reset gadget's driver-bus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.318 by commit...
GSD-2022-1003749 um: Fix out-of-bounds read in LDT setup
um: Fix out-of-bounds read in LDT setup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.198 by commit...
SUSE-SU-2022:2152-1 Security update for drbd
This update of drbd fixes the following issue: - rebuild with new secure boot key due to grub2 boothole 3 issues bsc1198581...
GHSA-R45X-GHR2-QJXC Duplicate Advisory: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s
Duplicate Advisory This advisory is a duplicate of GHSA-c5hx-w945-j4pq. This link is preserved to maintain external references. Original Description Affected versions of this crate did not implement Drop when zeroizedrop was used on an enum. This can result in memory not being zeroed out after...
CVE-2022-31050 Insufficient Session Expiration in TYPO3 Admin Tool
TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This...
SUSE-SU-2022:1928-1 Security update for php8
This update for php8 fixes the following issues: - Fixed filtervar bypass vulnerability bsc1197644...
GHSA-7MQG-5FGH-XH4R MediaWiki Incorrect Access Control vulnerability
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...
SUSE-SU-2022:1758-1 Security update for glib2
This update for glib2 fixes the following issues: - CVE-2021-28153: Fixed a dangling symlink when gfilereplace is used with GFILECREATEREPLACEDESTINATION bsc1183533...
MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...
GHSA-M899-6MH4-MPC5 MODX Revolution Incorrect Access Control vulnerability
MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...
Timing attack
Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user. This has been fixed by using using the crate constanttimeeq for comparison...
SUSE-SU-2022:1541-1 Security update for pgadmin4
This update for pgadmin4 fixes the following issues: - CVE-2022-0959: Fixed an unrestricted file upload bsc1197143...
GHSA-5X4F-7XGQ-R42X Object state limitation has no effect
Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of...
CVE-2022-24883 FreeRDP Server authentication might allow invalid credentials to pass
FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. FreeRDP based clients are not affected. RDP server...
GSD-2022-1001461 media: atomisp: fix dummy_ptr check to avoid duplicate active_bo
media: atomisp: fix dummyptr check to avoid duplicate activebo This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...