AZL-35153 CVE-2021-4158 affecting package qemu for versions less than 6.2.0-18

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition...

AZL-10617 CVE-2022-2873 affecting package kernel for versions less than 5.15.70.1-1

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2CSMBUSBLOCKDATA with the ioctl I2CSMBUS with malicious input data. This flaw allows a local user to crash the system...

prometheus/client_golang: Denial of service using InstrumentHandlerCounter

A denial of service attack was found in prometheus/clientgolang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability...

AZL-34947 CVE-2021-33644 affecting package libtar for versions less than 1.2.20-11

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulongname, causing an out-of-bounds read...

AZL-34948 CVE-2021-33645 affecting package libtar for versions less than 1.2.20-11

The thread function doesn’t free a variable t-thbuf.gnulonglink after allocating memory, which may cause a memory leak...

AZL-10445 CVE-2022-2580 affecting package vim for versions less than 9.0.0325-1

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102...

AZL-10103 CVE-2022-32207 affecting package curl for versions less than 7.84.0-1

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

AZL-41344 CVE-2022-1996 affecting package sriov-network-device-plugin for versions less than 3.7.0-1

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0...

AZL-9877 CVE-2022-27782 affecting package curl for versions less than 7.83.1-1

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...

CVE-2022-31500

In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions...

AZL-9831 CVE-2022-1851 affecting package vim for versions less than 8.2.5064-1

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2...

CVE-2022-22777

The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting XSS vulnerabilities that allow an unauthenticated attacker with network access to execute scripts targeting the affected system or the...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-27379

An issue in the component Argcomparator::comparerealfixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service DoS via specially crafted SQL statements...

JellyCMS 代码问题漏洞

JellyCMS is an enterprise website building management system. JellyCMS v3.8.1 and below has a security vulnerability that allows attackers to upload any file via app.adminControllersdb.php...

AZL-8840 CVE-2021-44531 affecting package nodejs for versions less than 16.14.0-1

Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js 12.22.9, 14.18.3, 16.13.2, and 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use...

AZL-8641 CVE-2022-25265 affecting package kernel for versions less than 5.15.26.1-1

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 e.g., with GCC 3.2.2 and Linux kernel 2.4.20. This can cause execution of bytes located in supposedly non-executable regions of a file...

AZL-33620 CVE-2022-21698 affecting package moby-engine for versions less than 20.10.27-3

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...

M-Files Web 和 M-Files Server 安全漏洞

M-Files Corporation M-Files Web is an intelligent information management platform from M-Files Corporation, USA. M-Files Server is a server for the M-Files system from M-Files Corporation. A security vulnerability exists in the M-Files Server and M-Files Web products versions lower than...

AZL-7486 CVE-2022-23218 affecting package glibc for versions less than 2.35-1

The deprecated compatibility function svcunixcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or if an application is not...