PUB-A-176754369

In ipucorejqsmsgtransportkernelwritesync of ipu-core-jqs-msg-transport.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-209481085

Bulletin has no description...

MAL-2022-6136 Malicious code in sixt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db59f1b325dca20e6aa112d88e03b0238a9e4b026480cd4c74b766991cbc5ade Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29725

An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file...

DLA-3037-1 libjpeg-turbo - security update

Bulletin has no description...

The Quad commits to strengthening cybersecurity in software, supply chains

The United States, Australia, and its Asian partners—India and Japan—have agreed to work on several cybersecurity initiatives on software, supply chain, and user data. The countries leaders, who convened in Tokyo on May 24, 2022, have met annually four times since the revival of the...

DLA-3035-1 libdbi-perl - security update

Bulletin has no description...

SUSE-SU-2022:1873-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2020-8025: Fixed outdated entries in permissions profiles for /var/lib/pcp/tmp/ bsc1171883...

GHSA-C75V-2VQ8-878F vulnerabilities

Vulnerabilities for packages: solr, kubeflow-katib...

DLA-3029-1 cups - security update

Bulletin has no description...

CVE-2022-27777

A XSS Vulnerability in Action View tag helpers = 5.2.0 and 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes...

CVE-2022-22577

An XSS Vulnerability in Action Pack = 5.2.0 and 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses...

DLA-3026-1 filezilla - security update

Bulletin has no description...

CVE-2022-30321

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0...

radare2 代码问题漏洞

radare2 is a set of libraries and tools for working with binary files. radare2 version 5.5.2 suffers from a denial of service vulnerability that stems from a NULL pointer dereference in the libr/bin/p/binsymbols.c binary symbols parser. An attacker could exploit this vulnerability to cause a deni...

mootools-more vulnerable to prototype pollution

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype...

GHSA-6PQM-PP65-MC26 Jenkins Gem Publisher Plugin stores credentials as plaintext

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

GHSA-52CX-VPHC-JMJM MantisBT allows XSS in manage_custom_field_edit_page.php

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page

Cross-site scripting XSS vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middl...