Server-side Request Forgery (SSRF)

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the allowAbsoluteUrls attribute being ignored in the call to the buildFullPath function from the HTTP adapter. An...

IBM FlashSystem 安全漏洞

IBM FlashSystem is a family of high-performance all-flash and hybrid flash storage solutions from International Business Machines IBM. A security vulnerability exists in IBM FlashSystem that originates from a specially crafted HTTP request bypassing RPCAdapter endpoint authentication...

SUSE CVE-2021-47642

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use strscpy to prevent buffer overflow Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidiasetupi2cbus it looks like that can't happen after examiniing the call...

UBUNTU-CVE-2021-47642

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use strscpy to prevent buffer overflow Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidiasetupi2cbus it looks like that can't happen after examiniing the call...

CVE-2022-49661

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbopen/close: fix memory leak The gsusb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usballoccoherent to allocate a number of USB request blocks URBs for RX, and...

CVE-2022-49661 can: gs_usb: gs_usb_open/close(): fix memory leak

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbopen/close: fix memory leak The gsusb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usballoccoherent to allocate a number of USB request blocks URBs for RX, and...

CVE-2022-49501 usbnet: Run unregister_netdev() before unbind() again

In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregisternetdev before unbind again Commit 2c9d6c2b871d "usbnet: run unbind before unregisternetdev" sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessa...

CVE-2022-49501

CVE-2022-49501 concerns the Linux kernel USB Ethernet (usbnet) path. The root cause is a use-after-free risk during disconnect caused by non-mirroring binding/unbinding order: usbnet_probe() binds then register_netdev(), whereas disconnect() previously unregisters before unbind(), leading to PHY ...

CVE-2022-49501

In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregisternetdev before unbind again Commit 2c9d6c2b871d "usbnet: run unbind before unregisternetdev" sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessa...

GHSA-8XFX-RJ4P-23JM vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, neuvector-dbgen-fips, prometheus-beat-exporter, age, restic-fips, kyverno-policy-reporter-ui, prometheus-postgres-exporter, capslock, nri-rabbitmq, gobuster, pombump, addon-resizer, fq, spire-server, gcsfuse, grafana-alloy-fips, velero,...

GHSA-J7VJ-RW65-4V26 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, neuvector-dbgen-fips, prometheus-beat-exporter, age, restic-fips, kyverno-policy-reporter-ui, prometheus-postgres-exporter, capslock, nri-rabbitmq, gobuster, pombump, addon-resizer, fq, spire-server, gcsfuse, grafana-alloy-fips, velero,...

GHSA-3F6R-QH9C-X6MM vulnerabilities

Vulnerabilities for packages: beats-fips, gke-gcloud-auth-plugin, neuvector-dbgen-fips, prometheus-beat-exporter, age, restic-fips, kubernetes-event-exporter-fips, prometheus-postgres-exporter, capslock, nri-rabbitmq, gobuster, pombump, fq, spire-server, gcsfuse, grafana-alloy-fips, velero,...

CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17. A patched version of the package is available...

Azure Linux 3.0 Security Update: cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter (CVE-2022-3162)

The version of cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3162 advisory. - Users authorized to list or watch one type of...

MAL-2025-1509 Malicious code in wasm-test-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware babc522f7d7785ae4fbf04d28f89e4db9b46fbec0308879dad88b4b27542f1bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wasm-test-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware babc522f7d7785ae4fbf04d28f89e4db9b46fbec0308879dad88b4b27542f1bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TFTP Fetch

Fetch and execute an MIPSLE payload from a TFTP server. Module Options msf use payload/cmd/linux/tftp/mipsle/meterpreterreversetcp msf payloadmeterpreterreversetcp show actions ...actions... msf payloadmeterpreterreversetcp set ACTION msf payloadmeterpreterreversetcp show options ...show and set...

HTTPS Fetch

Fetch and execute an AARCH64 payload from an HTTPS server. Module Options msf use payload/cmd/linux/https/aarch64/meterpreterreversehttps msf payloadmeterpreterreversehttps show actions ...actions... msf payloadmeterpreterreversehttps set ACTION msf payloadmeterpreterreversehttps show options...

CVE-2024-24852

Uncontrolled search path in some IntelR Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

SUSE CVE-2024-8901

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...