SUSE: Security Advisory (SUSE-SU-2022:2140-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulners Linux Audit API: Security Bulletin Publication Dates in Results

Hello everyone! In this short episode, I want to talk about the new feature in Vulners Linux API. Alternative video link for Russia: Linux security bulletin publication dates are now included in scan results. Why is it useful? A few words why this Linux Audit API is needed. You collect a list of...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2022-1791)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: ACS 3.70 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes RHACS. The updated image includes bug fixes and feature improvements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score...

Debian: Security Advisory (DSA-5154-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Anyone can add Bribe reward tokens and cause DoS

Lines of code Vulnerability details Impact The Bribe.notifyRewardAmount function does not have any access restriction. Anyone an attacker can frontrun and call this function to add arbitrary even malicious reward tokens up to MAXREWARDTOKENS = 16. An attacker is able to frontrun and add 16 fake...

spirit

Spirit - Network Pentest Tools We believe in making the inte...

CVE-2021-27548

There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode function in XFAScanner.cc in xpdf 4.03...

maxFee is not checked against a max value while being updated

187 comment Warden: catchup Lines of code Vulnerability details changeFee maxFee should be checked against a maximum value like 10% to make sure it is not set too high by mistake. Impact maxFee can be set beyond limits which would mess up fee calculations. Proof of Concept getTransferFee function...

CVE-2022-21190

CVE-2022-21190 affects convict before 6.2.3. The issue is a prototype pollution bypass tied to CVE-2022-22143: the fix that uses startsWith to block dangerous paths does not fully prevent pollution because attackers can prepend paths (e.g., foo.proto ) to bypass the check. Public sources (includi...

GHSA-4GJJ-R7W8-42CQ Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth By...

Fedora: Security Advisory for golang-github-prometheus-alertmanager (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

VMware Workspace ONE Access Template Injection / Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMware Workspace ONE Access CVE-2022-22954', 'Description' = %q This module exploits CVE-2022-22954, an unauthenticated server-side template...

SUSE: Security Advisory (SUSE-SU-2022:1479-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-13668 · Fapolicyd +4 · Fapolicyd +4

Name of the Vulnerable Software and Affected Versions: fapolicyd affected versions not specified Description: A vulnerability was found due to an assumption on how glibc names the runtime linker. A build time regular expression may not correctly detect the runtime linker, causing pattern detectio...

Fedora: Security Advisory for golang-contrib-opencensus-resource (FEDORA-2022-3a63897745)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GSD-2022-1002278 NFSD: prevent integer overflow on 32 bit systems

NFSD: prevent integer overflow on 32 bit systems This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

GSD-2022-1001853 vfio/pci: fix memory leak during D3hot to D0 transition

vfio/pci: fix memory leak during D3hot to D0 transition This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001789 f2fs: use spin_lock to avoid hang

f2fs: use spinlock to avoid hang This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit 2eff60346e7ae1a24cd868b8fdcf58e946e7dde1. Fo...