Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another

Impact When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set. There are...

Security Bulletin: IBM DataPower Gateway affected by vulnerabilities in Redis

Summary IBM has addressed the following CVEs, which may affect Gateway Peering and Quota Enforcement. Vulnerability Details CVEID:CVE-2022-24736 DESCRIPTION: Redis is vulnerable to a denial of service, caused by a NULL pointer dereference. By loading a specially crafted Lua script, a local...

GHSA-G86G-CHM8-7R2P check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...

PT-2022-23964 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.2.53575 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. Th...

PT-2022-23967 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.2.53575 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. Th...

PT-2022-20003 · Unknown · Elliegrid Android Application

Name of the Vulnerable Software and Affected Versions: EllieGrid Android Application version 3.4.1 Description: The EllieGrid Android Application is vulnerable to Code Injection. The application evaluates user input as code, allowing for remote exploitation. Recommendations: For EllieGrid Android...

PT-2022-17517 · Sourcecodester · Sourcecodester Garage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Garage Management System version 1.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /php action/createUser.php. The manipulation of the userName argument with a specific...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2022-2156)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-23731 · Veritas · Veritas Netbackup

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup versions 8.1.x through 8.1.2 Veritas NetBackup version 8.2 Veritas NetBackup versions 8.3.x through 8.3.0.2 Veritas NetBackup versions 9.x through 9.0.0.1 Veritas NetBackup versions 9.1.x through 9.1.0.1 Description: An issu...

PT-2022-4008 · Jenkins · Jenkins Buckminster Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Buckminster Plugin versions 1.1.1 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Buckminster Plugin, allowing remote attackers with Overall/Read permission to gain unauthorized...

PT-2022-4016 · Jenkins · Jenkins Coverity Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.11.4 and earlier Description: A missing permission check in the Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. This issue...

Server memory information leak via SMB1.

Description Please note that only versions of Samba prior to 4.11.0 are vulnerable to this bug by default. Samba versions 4.11.0 and above disable SMB1 by default, and will only be vulnerable if the administrator has deliberately enabled SMB1 in the smb.conf file. All versions of Samba with SMB1...

DEBIAN-CVE-2022-33745

insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF see XSA-273, PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / val...

CVE-2022-33745

insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF see XSA-273, PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / val...

PT-2022-10249 · Lrzip +1 · Lrzip +1

Name of the Vulnerable Software and Affected Versions: lrzip version 0.641 Description: An issue was discovered in the ucompthread function in stream.c at line 1538, which is a use-after-free. Recommendations: For lrzip version 0.641, consider disabling the ucompthread function as a temporary...

PT-2022-17036 · Unknown · Qr Code Generator

Name of the Vulnerable Software and Affected Versions: QR Code Generator version 5.2.7 Description: A vulnerability in the component process.php of QR Code Generator allows attackers to perform directory traversal. Recommendations: For QR Code Generator version 5.2.7, consider restricting access ...

PT-2022-9397 · Npm · @Ianwalter/Merge +1

Name of the Vulnerable Software and Affected Versions: @ianwalter/merge versions all Description: The issue concerns Prototype Pollution via the main merge function. The maintainer suggests using @generates/merger instead, as @ianwalter/merge is deprecated. Recommendations: For all versions,...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...