SUSE CVE-2015-0413

Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability...

SUSE CVE-2015-1865

fts.c in coreutils 8.4 allows local users to delete arbitrary files...

SUSE CVE-2016-6153

osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service application crash, or have unspecified other impact by leveraging use of the current working directory for...

SUSE CVE-2017-8072

The cp2112gpiodirectioninput function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors...

SUSE CVE-2019-4473

Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984...

SUSE CVE-2022-4842

A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attrpunchhole was found. A local user could use this flaw to crash the system...

inital share manipulation attack possible in Vault

Lines of code Vulnerability details Description This is the classic share inflation attack described here: The popcorn Vault is an abstraction on top of other vaults which acts like adapters to wrap other yield bearing protocols. Hence the asset in Vault are the shares in this adapter. An early...

Authentication Bypass for passport-wsfed-saml2

Overview A remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks e.g without access to a valid us...

CVE-2022-41933 Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the reset a forgotten password feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and newer versions. Note that it only...

CVE-2022-41933 Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the reset a forgotten password feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and newer versions. Note that it only...

Wrong calculation in function LBRouter._getAmountsIn make user lose a lot of tokens when swap through JoePair (most of them will gifted to JoePair freely)

Lines of code Vulnerability details Vulnerable detail Function LBRouter.getAmountsIn is a helper function to return the amounts in with given amountOut. This function will check the pair of token and tokenNext is JoePair or LBPair using binStep. If binStep == 0, it will be a JoePair otherwise it...

Fee on transfer tokens can make users receive less than they are supposed to

Lines of code Vulnerability details Impact Some tokens take a transfer fee e.g. STA, PAXG. Tokens like these will be supported because the vested amount will be the amount that was actually transferred i.e. the balance of the contract after the transfer, but it will cause the user to receive less...

MGASA-2022-0285 Updated nvidia-current packages fix security vulnerabilities

Updated nvidia-current packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko, where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of...

PT-2022-15773 · Western Digital +1 · Sweet B Library +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned fro...

DoS attack on claiming rewards can lead to user never being able to claim

Lines of code Vulnerability details Proof of Concept: the stake function can be called for a different recipient than msg.sender. Each time you stake tokens your warmUpInfo.expiry or the time when you are able to claim rewards grows by warmUpPeriod as is visible the last line here not the line wi...

GHSA-9W9F-6MG8-JP7W Missing Role Based Access Control for the REST handlers in bleve/http package

Impact What kind of vulnerability is it? Who is impacted? Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. https://github.com/blevesearch/bleve-explorer These HTTP methods paves way for exploitation of a node’s filesystem where the bleve index...

AZL-10105 CVE-2022-1882 affecting package kernel for versions less than 5.15.70.1-1

A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe postonenotification after freepipeinfo that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system...

CVE-2022-23065

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

Vulnerability fixed in Microsoft Dynamics

A vulnerability has been fixed in Microsoft Dynamics. The vulnerability potentially allows an authenticated user to to execute arbitrary SQL code on the Dynamics database. Microsoft Dynamics: |----------------|------|-------------------------------------| | CVE ID | CVSS | Impact |...

PT-2022-16878

Name of the Vulnerable Software and Affected Versions Moment.js versions 1.0.1 through 2.29.1 Description A path traversal vulnerability impacts npm server users of Moment.js, especially if a user-provided locale string is directly used to switch moment locale. This issue allows an unauthenticate...