13363 matches found
GSD-2022-1003852 tipc: check attribute length for bearer name
tipc: check attribute length for bearer name This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.247 by commit...
PT-2022-31789
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.122 Description The issue concerns checking the attribute length for the bearer name. It was introduced in version v4.17 and fixed in version v5.10.122. The actual impact and attack plausibility have not ye...
PT-2022-31533
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.47 Description The issue concerns the tipc module, where the attribute length for the bearer name is not properly checked. This is an automated ID intended to aid in discovery of potential security...
PT-2022-32115
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.247 Description The issue concerns the tipc module, where the length of the bearer name attribute is not properly checked. This is an automated ID intended to aid in discovery of potential security...
PT-2022-31230
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.15 Description The issue concerns the tipc module, where the length of the bearer name attribute is not properly checked. This is an automated identification of a potential security issue, and its actual...
CVE-2021-33651
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depthmultiplier is 0, it will cause a division by 0 exception...
Download Manager < 3.2.44 - Reflected Cross-Site Scripting
The plugin does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/edit.php?posttype=wpdmpro=wpdm-stats=historyids=1&"...
Cross-site Scripting vulnerability in Jenkins
Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute of l:icon since Jenkins 2.335 without further escaping. This vulnerability is known to be exploitable by attackers with...
CVE-2022-33114
Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinalcms/system/dict/list...
Jenkins cross-site scripting vulnerability
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins suffers from a cross-site scripting vulnerability that stems from the title attribute and alt attribute not being...
June 23, 2022—KB5014665 (OS Build 20348.803) Preview
June 23, 2022—KB5014665 OS Build 20348.803 Preview Applies To Windows Server 2022 Note For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Windows Server 2022, see its update history page. No...
CLSA-2022-1655901847 Fix CVE(s): CVE-2022-2042
SECURITY UPDATE: Using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: Initialize "attr" and check for empty line early - CVE-2022-2042...
PT-2022-22038 · Jenkins · Jenkins
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.321 through 2.355 Jenkins LTS versions 2.332.1 through 2.332.3 Description: The HTML output generated for new symbol-based SVG icons in Jenkins includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute...
CVE-2022-34171: Improper Neutralization of Input During Web Page Generation
In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...
WP Event Manager < 3.1.28 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting PoC Against any authenticated user: https://example.com/event-dashboard/?searchkeywords=aaaa"...
Cross-site Scripting (XSS)
Overview svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization and to improper escape of attributes when using objects during SSR Server-Side Rendering. Exploiting this vulnerability is...
Duplicate Advisory: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s
Duplicate Advisory This advisory is a duplicate of GHSA-c5hx-w945-j4pq. This link is preserved to maintain external references. Original Description Affected versions of this crate did not implement Drop when zeroizedrop was used on an enum. This can result in memory not being zeroed out after...
GHSA-R45X-GHR2-QJXC Duplicate Advisory: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s
Duplicate Advisory This advisory is a duplicate of GHSA-c5hx-w945-j4pq. This link is preserved to maintain external references. Original Description Affected versions of this crate did not implement Drop when zeroizedrop was used on an enum. This can result in memory not being zeroed out after...
CVE-2022-2042
A heap use-after-free vulnerability was found in Vim's skipwhite function of the src/charset.c file. This flaw occurs because of an uninitialized attribute value and freed memory in the spell command. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a...