PT-2022-37625 · Opensuse +3 · Xtrabackup

This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history boo1170644 - CVE-2020-29488: Changes in how absolute paths are handled boo1205581...

Security update for tumbler (moderate)

openSUSE Security Update: Security update for tumbler Announcement ID: openSUSE-SU-2022:10206-1 Rating: moderate References: 1203644 1205210 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: This update for tumbler fixes the...

PT-2022-26170 · Unknown · Knative.Dev/Func

Name of the Vulnerable Software and Affected Versions: knative.dev/func versions prior to 1.8.1 Description: The issue affects developers using malicious or compromised third-party buildpacks, potentially exposing their registry credentials or local docker socket to a malicious lifecycle containe...

SUSE-SU-2022:4069-1 Security update for php7

This update for php7 fixes the following issues: - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont bsc1204979. - CVE-2022-37454: Fixed buffer overflow in hashupdate on long parameter bsc1204577. - Version update to 7.4.32...

SUSE-SU-2022:4067-1 Security update for php7

This update for php7 fixes the following issues: - Version update to 7.2.34 jscSLE-23639 - CVE-2022-37454: Fixed SHA-3 buffer overflow bsc1204577. - Fix integer overflow in PHPSHA3bits bsc1204577c26...

PT-2022-26024 · Woocommerce · Viszt Péter'S Integration For Szamlazz.Hu & Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin versions = 5.6.3.2 Csomagpontok és szállítási címkék WooCommerce-hez plugin versions = 1.9.0.2 Description: The issue concerns multiple Cross-Site Request Forgery CSRF...

Cradlepoint IBR600

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low attack complexity Vendor: Cradlepoint Equipment: IBR600 Vulnerabilities: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute code and native system commands. 3. TECHNICAL DETAILS 3.1...

SUSE: Security Advisory (SUSE-SU-2022:3997-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:3997-1 Security update for php7

This update for php7 fixes the following issues: - Version update to 7.4.33: - CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont bsc1204979. - CVE-2022-37454: Fixed buffer overflow in hashupdate on long parameter bsc1204577. - Version update to 7.4.32...

CVE-2022-41918 Issue with fine-grained access control of indices backing data streams

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules document-level security, field-level security and field masking where they are not correctly applied to the indices that back data streams...

PT-2022-35532 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.5 through v5.10.149 Description: A refcount leak bug was found in the of lpddr3 get ddr timings function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35395 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.76 Description: The issue concerns the initialization of registers in the arm64 architecture, specifically related to the Memory Tagging Extension MTE feature. The actual impact and potential for attacks...

CVE-2022-43687

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

PT-2022-35412 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.74 Description: The issue concerns the nilfs2 file system in the Linux Kernel, where checkpoint acquisition failure is not properly handled, potentially leading to security vulnerabilities. The actual impa...

PT-2022-35506 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: A potential issue exists where a memory leak could occur due to the addition of task work to a kernel thread. The actual impact and attack plausibility have not yet been proven...

PT-2022-35130 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: A potential memory leak was identified in the ext4 fc record regions function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-35064 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.3 through v6.0.2 Description: The issue is related to RDMA/siw, where a fix is applied to ensure that QP destroy waits for all references to be dropped. The actual impact and attack plausibility have not yet been...

PT-2022-35159 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns the initialization of registers in the arm64 architecture, specifically related to the MTE Memory Tagging Extension feature. The actual impact and potential for attacks hav...

PT-2022-27048 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions below 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2 Description: The issue is related to Reflected XSS in the multilingual report due to un-sanitized output. Recommendations: For Concrete CMS versions below 8.5.10,...

PT-2022-27011 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions prior to 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2 Description: The issue allows for Stored Cross-Site Scripting XSS in the dashboard/system/express/entities/associations endpoint because Concrete CMS permits...