SUSE CVE-2010-2496

stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer...

SUSE CVE-2020-11054

In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow colors.statusbar.url.warn.fg. However, when the affected website was subsequently loaded again, the UR...

SUSE CVE-2021-29470

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An...

SUSE CVE-2021-32690

Helm is a tool for managing Charts packages of pre-configured Kubernetes resources. In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. Thi...

SUSE CVE-2021-32705

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in...

SUSE CVE-2021-39212

ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribute in both open and proprietary applications. In affected versions and in certain cases, Postscript files could be read and written when specifically excluded...

SUSE CVE-2021-41202

TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the tf.range kernel, there is a conditional statement of type int64 = condition ? int64 : double. Due to C++ implicit conversion rules, both branches of the condition...

DEBIAN-CVE-2023-22490

Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort loca...

GSD-2023-1001878 block: ublk: extending queue_size to fix overflow

block: ublk: extending queuesize to fix overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit...

SUSE-SU-2023:0375-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: IBM Security Update November 2022: bsc1205302, bsc1204703 - CVE-2022-3676: A security vulnerability was fixed in version 8.0.7.20, adding the reference here...

PT-2023-34744 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v6.1.7 through v6.1.8 Description: The issue is related to a potential security vulnerability in the io uring/poll component. It was introduced in version v6.1.7 and fixed in version v6.1.8. The actual impact and attack...

CVE-2023-22730 Improper Input Validation of Clearance sale in cart

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in...

PT-2023-33608 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v4.19 through v6.0.16 Description: A memory leak issue was discovered, which may have potential security implications. The issue was introduced in version v4.19 and is fixed in version v6.0.17. Recommendations: For Linux...

PT-2023-33967 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: A memory leak issue exists in the Linux Kernel. The issue was introduced in version v4.9 and is fixed in version v5.15.87. Recommendations: For versions prior to v5.15.87, update to version...

GSD-2022-1008087 bpf: Fix wrong reg type conversion in release_reference()

bpf: Fix wrong reg type conversion in releasereference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.155 by commit...

CVE-2022-43553

A remote code execution vulnerability in EdgeRouters Version 2.0.9-hotfix.4 and earlier allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later...

UBUNTU-CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

Stack overflow

TensorFlow is an open source platform for machine learning. If tf.rawops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56...

PT-2022-37526 · Vsftpd · Vsftpd

Name of the Vulnerable Software and Affected Versions: vsftpd affected versions not specified Description: The issue concerns the removal of unsupported systemd hardening options. No information is provided about the estimated number of potentially affected devices or real-world incidents where...

PT-2022-36710 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Stack-use-after-return READ 4. The crash state involves several functions, including gs type2 interpre...