device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

...

Red Hat device-mapper-multipath 安全漏洞

Red Hat device-mapper-multipath is a device mapper multipath from Red Hat, Inc. Allows you to configure multiple I/O paths between server nodes and storage arrays into a single device. A security vulnerability exists in Red Hat device-mapper-multipath that stems from the multipathd daemon listeni...

AZL-44541 CVE-2022-37598 affecting package js-jquery 3.5.0-4

Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report...

The vulnerability of the AbstractBasicAuthHandler class in the urllib.request component of the Python programming language allows a hacker to trigger a denial-of-service attack.

The vulnerability of the AbstractBasicAuthHandler class in the urllib.request component of the Python programming language is related to the use of an inefficient regular expression. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

PT-2022-37221 · Git +1 · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A security exception crash was reported, involving the java.base/java.util.Arrays.copyOf, java.base/java.lang.AbstractStringBuilder.ensureCapacityInterna...

CVE-2022-20358

In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for...

PT-2022-14584 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: The issue is related to a missing permission check in the startSync method of AbstractThreadedSyncAdapter.java, which could allow access to protected content of content providers...

Denial Of Service

Open policy agent is vulnerable to Denial of Service. An attacker is able to crash the system via a maliciously crafted inputs via the abstract systax tree parser in ast/compile.go...

UBUNTU-CVE-2022-34476

ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox 102...

CVE-2022-33107

ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

Mozilla Firefox 输入验证错误漏洞

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox is vulnerable to an input validation error that stems from a lack of ASN.1 parsing restrictions on error formats. An attacker could exploit this vulnerability to compromise the affected system...

Malicious code in sfdc-abstract-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d4fb0d0033264a928716326514774becd436c82d3a722325c147978b06c48fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sfdc-abstract-plot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 054964122d2a8e86e2c0966558d1ae1e8c3e220bcd91770788fa330bf3ed6364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6044 Malicious code in sfdc-abstract-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d4fb0d0033264a928716326514774becd436c82d3a722325c147978b06c48fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6045 Malicious code in sfdc-abstract-plot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 054964122d2a8e86e2c0966558d1ae1e8c3e220bcd91770788fa330bf3ed6364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6043 Malicious code in sfdc-abstract-cartesian-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 276c21f96d0fab4f0a31ce90298fee2aa61a7083e79ed54ed72e1d2dc4315c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sfdc-abstract-cartesian-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 276c21f96d0fab4f0a31ce90298fee2aa61a7083e79ed54ed72e1d2dc4315c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2022-1654525948 Fixed CVEs in python2-pip-18.module_el8.4.0+2051+0b56c8de: CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-4189

CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...

BinAbsInspector - Vulnerability Scanner For Binaries

BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...