CVE-2022-40152 vulnerabilities

Vulnerabilities for packages: spark, sonarqube-10...

PYSEC-2022-278

Cross-Site Request Forgery CSRF in GitHub repository ikus060/rdiffweb prior to 2.4.3...

PYSEC-2022-277

LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69...

CVE-2022-38306

LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc...

CVE-2022-39203 Parsing issue in matrix-org/node-irc leading to room takeovers

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The...

GHSA-FJ2M-W3WV-X9PR vulnerabilities

Vulnerabilities for packages: trino...

PT-2022-24346 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: Cuppa CMS version 1.0 Description: The issue is related to an arbitrary file upload vulnerability via the File Manager. This allows for potential malicious file uploads. Recommendations: For Cuppa CMS version 1.0, consider disabling the File...

DLA-3103-1 zlib - security update

Bulletin has no description...

DSA-5228-1 gdk-pixbuf - security update

Bulletin has no description...

CVE-2021-40648

In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fdnextsize, bknextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory...

CVE-2022-38286

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list...

PT-2022-23326 · Unknown · Culture Object

Name of the Vulnerable Software and Affected Versions: Culture Object plugin versions prior to 4.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into the...

SUSE-SU-2022:3162-1 Security update for libyajl

This update for libyajl fixes the following issues: - CVE-2022-24795: Fixed heap-based buffer overflow when handling large inputs bsc1198405...

PT-2022-18245 · Unknown · Rosariosis Student Information System +1

Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 10.0 RosarioSIS Student Information System versions prior to 10.1 Description: The issue is related to improper handling of length parameter inconsistency in the GitHub repository francoisjacquet/rosariosis...

Improper Input Validation

Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks historical or actual could encounter a MultiESDTNFTTransfer transaction like this: MultiESDTNFTTransfer with a missing function name. Basic functionality li...

PYSEC-2022-43069

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue...

CVE-2022-3008 Command Injection on tinygltf

The tinygltf library uses the C library function wordexp to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. W...

Prototype Pollution

matrix-js-sdk is vulnerable to Prototype Pollution. The vulnerability exists because the events sent with special strings in key places can temporarily disrupt or impede in the library, which leads to excluding or corrupting runtime data...

CVE-2022-36640

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...

SUSE-SU-2022:2985-1 Security update for open-vm-tools

This update for open-vm-tools fixes the following issues: - CVE-2022-31676: Fixed an issue that could allow unprivileged users inside a virtual machine to escalate privileges bsc1202657...