`tokio::io::ReadHalf<T>::unsplit` is Unsound

tokio::io::ReadHalf::unsplit can violate the Pin contract The soundness issue is described in the tokio/issues5372 Specific set of conditions needed to trigger an issue a !Unpin type in ReadHalf is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust...

at.molindo:esi4j (>=3.0.0 <=3.0.2), at.molindo:scrutineer (=3.0.0) +9 more potentially affected by CVE-2022-24913 via com.fasterxml.util:java-merge-sort (>=1.0.0 <=1.0.2)

com.fasterxml.util:java-merge-sort MAVEN version =1.0.0, =3.0.0, =6.5.0, =2.3.0, =0.5.3, =0.5.3, =0.9.0, =0.5.3, =0.5.3, =0.9.0, =1.0.2, =1.0.4 Source cves: CVE-2022-24913 Source advisory: SNYK:JAVA-COMFASTERXMLUTIL-3227926...

Node v18.13.0 (LTS)

Node v18.13.0 LTS By Danielle Adams, Jan 06, 2023 Notable changes Add support for externally shared js builtins By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing...

CVE-2020-36634 Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting

A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is...

CVE-2020-36634

This CVE (CVE-2020-36634) affects Indeed Engineering util up to version 1.0.33. The vulnerability resides in the function visit/appendTo of varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java, where input is mishandled and leads to cross-site scripting. It ...

CVE-2022-42930

If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the ThirdPartyUtil component. This vulnerability affects Firefox 106...

Amazon Linux 2022 : util-linux (ALAS2022-2022-218)

The version of util-linux installed on the remote host is prior to 2.37.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-218 advisory. - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to...

PT-2022-36551 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.300 Description: The issue is related to the ASoC soc-utils, where the removal of exit for snd soc util exit may potentially lead to security vulnerabilities. However, the actual impact and attack...

Amazon Linux 2 : util-linux (ALAS-2022-1878)

The version of util-linux installed on the remote host is prior to 2.30.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1878 advisory. A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability...

Amazon Linux 2 : util-linux (ALAS-2022-1901)

The version of util-linux installed on the remote host is prior to 2.30.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1901 advisory. A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline...

Medium: util-linux

Issue Overview: A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on behalf of the user who triggers the umount autocompletion. CVE-2018-7738...

Medium: util-linux

Issue Overview: A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error...

Stack Buffer Overflow

pjproject, edge is vulnerable to stack buffer overflow. The vulnerability exists because pjsip users that use STUN in their applications, either by: setting a STUN server in their account/media config in pjsua/pjsua2 level, or directly using pjlib-util/stunsimple api...

RUSTSEC-2022-0080 parity-util-mem Unmaintained

The crate has been deprecated and will receive no updates with no repository source. The crate has a warning surrounding it's use related to global allocator use that may lead to UB...

abci-storage (=0.0.3), bench-trie (>=0.12.0 <=0.12.2) +295 more potentially affected by unknown CVE via parity-util-mem (>=0.10.2 <=0.9.0)

parity-util-mem CARGO version =0.10.2, =0.12.0, =0.7.0, =0.8.8, =1.0.0, =2.0.0, =0.0.7, =0.1.0, =1.0.0 - edge-signaling =1.0.0 - edge-treasury-reward =1.0.0 - edge-voting =1.0.0 - edgeware-primitives =3.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0080...

PT-2022-37431 · Unknown · Parity-Util-Mem

Name of the Vulnerable Software and Affected Versions: parity-util-mem affected versions not specified Description: The issue concerns the use of a global allocator that may lead to undefined behavior UB. There is a warning related to its use. Recommendations: At the moment, there is no informati...

CVE-2022-21126

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it...

Ubuntu: Security Advisory (USN-5737-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5737-1: APR-util vulnerability

It was discovered that APR-util did not properly handle memory when using SDBM database files. A local attacker with write access to the database can make a program or process using these functions crash, and cause a denial of service...

systemd 资源管理错误漏洞

systemd is a Linux-based system and service manager from the individual developer Lennart Poettering in Germany. It is compatible with SysV and LSB startup scripts and provides a framework for representing dependencies between system services. A security vulnerability exists in systemd versions 2...