GSD-2022-1002966 nbd: fix possible overflow on 'first_minor' in nbd_dev_add()

nbd: fix possible overflow on 'firstminor' in nbddevadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1002889 staging: rtl8712: fix uninit-value in r871xu_drv_init()

staging: rtl8712: fix uninit-value in r871xudrvinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.15 by commit...

GSD-2022-1002735 eth: tg3: silence the GCC 12 array-bounds warning

eth: tg3: silence the GCC 12 array-bounds warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...

GSD-2022-1002614 f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

f2fs: fix to do sanity check on block address in f2fsdozerorange This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...

CVE-2021-40944

In GPAC MP4Box 1.1.0, there is a Null pointer reference in the function gffilterpidgetpacket function in src/filtercore/filterpid.c:5394, as demonstrated by GPAC. This can cause a denial of service DOS...

Missing Release of Memory after Effective Lifetime

DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack...

CVE-2022-24444: Hybridsessions does not expire session id on logout

More info at https://www.silverstripe.org/download/security-releases/cve-2022-24444...

CVE-2022-28803: Stored XSS in link tags added via XHR

More info at https://www.silverstripe.org/download/security-releases/cve-2022-28803...

GHSA-P782-XGP4-8HR8 golang.org/x/sys/unix has Incorrect privilege reporting in syscall

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. Specific Go Packages Affected golang.org/x/sys/unix...

CVE-2022-34295

totd before 1.5.3 does not properly randomize mesg IDs...

CVE-2022-34300

In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData...

MAL-2022-5908 Malicious code in sageone_api_ruby_sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67c460c228e823f0c5c8ff20c43b3bea00ea76438eb77c1f2d539619b7354d2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4563 Malicious code in merlin-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50d7dcf4fcdd9219988153659111f9f161edaceb483c6642ac3ef3c334038c31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7204 Malicious code in wm-salesforce-lightning-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 735b5048c03ae40bcbc9cf73fafbc170efb003b51a37240dcd3b1ac3b48e0971 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2131 Malicious code in commonweb-dynamic-routing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71b93dd72fab608c353b277edc3606970d23565abb0aa6f79b894e88f1da1d1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-576 Malicious code in @sbtweb/chat-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98da8f5b939eeb94617bce10dd625c39b582c21f0057799cdc2ae93196291802 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-981 Malicious code in amplify-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c45ca3aa689f3135c4de255dcae8c501fc865a035dd4832c534f21488f8b8ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5185 Malicious code in package_avvo_dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ebf9b1d3ac13c81686e8068798777d8031bd6a284c289d8cbbac82edd8a54b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3554 Malicious code in hakunamatata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17980f9b4fe3a1de259bb126feddb0d277473b6aaedc68c17f1e36a126c9b118 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4463 Malicious code in majortest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9caaf59d9a436b5fdd83c090c397dcfa7d088e36c36150176cc13656416610c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...