Security Bulletin: Publicly disclosed vulnerability from Kernel affects IBM Netezza Host Management

Summary Kernel is used by IBM Netezza Host Management. This bulletin provides mitigation for the reported CVE. Vulnerability Details CVEID: CVE-2022-22942 DESCRIPTION: Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by improper file descriptor...

MGASA-2022-0204 Updated supertux packages fix security vulnerability

squirrel: threadcall in sqbaselib.cpp lacks a certain sqreservestack call CVE-2022-30292...

CVE-2022-28862

In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized and unexpected operations against the remo...

Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials

Call Remote Job Plugin stores a password unencrypted in job config.xml files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

GHSA-8MPQ-FMR3-6JXV LXD vulnerable to Race Condition

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer has an unsafe Chmod call that races against the stat in the Filepath.Walk function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. Specific Go Packages Affected...

SUSE-SU-2022:1829-1 Security update for go1.18

This update for go1.18 fixes the following issues: - CVE-2022-29526: Fixed faccessat system call operation that checked the wrong group bsc1199413. - go1.18.2 released 2022-05-10 bsc1193742...

Halibut 资源管理错误漏洞

Halibut is a secure, RPC-based open source communication framework. Halibut version 1.2 contains a denial-of-service vulnerability that stems from a mix-up in the cleanupindex directive in index.c, which is responsible for freeing memory. An attacker could exploit this vulnerability to cause a...

May 24, 2022—KB5014021 (OS Build 20348.740) Preview

None None...

New Robo-Dialing Campaign Lets Users Prank Call Russian Bureaucrats

By Waqas If you want to prevent Russian officials from performing their government duties, theres a website that can fulfill… This is a post from HackRead.com Read the original post: New Robo-Dialing Campaign Lets Users Prank Call Russian Bureaucrats...

Microsoft DWM Core Library Elevation of Privilege Vulnerability (CNVD-2022-45485)

Microsoft DWM Core Library is the United States Microsoft Microsoft company's Microsoft windows get a core library. An elevation of privilege vulnerability exists in the Microsoft DWM Core Library. The vulnerability arises from an incorrect programmatic call to a high-level native procedure. An...

This Hacktivist Site Lets You Prank Call Russian Officials

To protest the war in Ukraine, WasteRussianTime.today auto-dials Russian government officials, connects them to each other, and lets you listen in to their confusion...

WordPress Call Now Buttons plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of the WordPress Call Now Buttons plugin prior ...

GHSA-9G2J-5685-H44H Apache Ambari SSRF Vulnerability

Server-side request forgery SSRF vulnerability in the proxy endpoint api/v1/proxy in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call...

CVE-2022-1455

The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled...

Cross site scripting

The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled...

CVE-2022-1455

The CVE-2022-1455 entry concerns the WordPress Call Now Button plugin prior to version 1.1.2, where a parameter output into a hidden input attribute is not escaped, enabling Reflected Cross-Site Scripting. The vulnerability affects versions before 1.1.2; the root cause is failure to escape user-c...

CVE-2022-1455 Call Now Button < 1.1.2 - Reflected Cross-Site Scripting

The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled...

ACCEL-PPP 缓冲区错误漏洞

ACCEL-PPP is a high performance Pptp/L2tp/Pppoe/Ipoe server for Linux. A security vulnerability exists in ACCEL-PPP version 1.12.0, which stems from an out-of-bounds read in postmsg when processing callclearrequest...

WordPress plugin Call Now Button 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of the WordPress Call Now Buttons plugin prior ...

low-level call not validated in lidoVault

Lines of code Vulnerability details Impact In lines 140 and 141 a low-level transfer is performed and first it is reversed and then it is validated with the require if it was done correctly. This can generate many problems, since the transaction may not be carried out and a message may be returne...