14850 matches found
XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
Impact It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. For example, attachment a file with name .jpg will execute the alert. Patches This issue has been patched in XWiki 13.10.6 and...
Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata
Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf clients 0.3.2 are susceptible to an attack where attackers can cause the same signature from the same publ...
CVE-2022-3176
There exists a use-after-free in iouring in the Linux kernel. Signalfdpoll and binderpoll use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the iouring poll doesn't handle POLLFREE. This allows a...
CVE-2022-3176 Use-after-free in io_uring in Linux Kernel
There exists a use-after-free in iouring in the Linux kernel. Signalfdpoll and binderpoll use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the iouring poll doesn't handle POLLFREE. This allows a...
PT-2022-33409 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue is related to the btrfs filesystem in the Linux Kernel, where the reloc control is not unset if a transaction commit fails in the prepare to relocate function. The actual impact an...
PT-2022-7350
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.0 Description The issue is related to an improper update of reference count in io uring, leading to Use-After-Free and Local Privilege Escalation. When io msg ring is invoked with a fixed file, it calls io fput...
LIEF contains segmentation violation
LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::fileoffset at /MachO/SegmentCommand.cpp. Commit 7acf0bc4224081d4f425fcc8b2e361b95291d878 contains a patch...
GHSA-42VG-2Q93-FJ6J LIEF vulnerable to heap based buffer overflow via print_binary function
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function printbinary at /c/machoreader.c. Commit 0033b6312fd311b2e45e379c04a83d77c1e58578 contains a patch...
GHSA-52XX-R3G2-P8JM LIEF vulnerable to heap based buffer overflow
LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc. Commit 53bf680ef494a835e2c4a5de328ca85416a03a5a contains a patch...
CVE-2022-38306
LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc...
CVE-2022-38497
LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69...
CVE-2022-38307
LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::fileoffset at /MachO/SegmentCommand.cpp...
CVE-2022-38496
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp...
CVE-2022-38306
LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc...
CVE-2022-38495
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function printbinary at /c/machoreader.c...
CVE-2022-38497
LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69...
CVE-2022-38307
LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::fileoffset at /MachO/SegmentCommand.cpp...
Authentication flaw
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp...
