SUSE CVE-2020-10236

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of createUserdataConf in...

SUSE CVE-2020-13696

An issue was discovered in LinuxTV xawtv before 3.107. The function devopen in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to...

SUSE CVE-2021-43816

containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface CRI, an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any...

Malicious code in dep-conf-test-tal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11ab34becb955a22cbb02099997e4c3301a8dcfb0559a59ebcb0a32770e7bdc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dep-conf-test-tal2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b97fd877e41e24812639dbd001e200927c3673576a2de4c71c76cde33df0dda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-233 Malicious code in dep-conf-test-tal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11ab34becb955a22cbb02099997e4c3301a8dcfb0559a59ebcb0a32770e7bdc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-234 Malicious code in dep-conf-test-tal2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b97fd877e41e24812639dbd001e200927c3673576a2de4c71c76cde33df0dda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-36647

A vulnerability classified as critical has been found in YunoHost-Apps transmissionynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to...

PT-2023-11817 · Yunohost · Transmission Ynh

Name of the Vulnerable Software and Affected Versions: YunoHost-Apps transmission ynh affected versions not specified Description: A critical vulnerability has been found in YunoHost-Apps transmission ynh, affecting an unknown function of the file conf/nginx.conf. The manipulation leads to path...

Transmission for YunoHost SQL注入漏洞

Transmission for YunoHost is a YunoHost transmission package from the individual developers of YunoHost-Apps. Transmission for YunoHost suffers from a SQL injection vulnerability that originates from an unknown function in the file conf/nginx.conf that is manipulated to cause path traversal...

Cross-site Scripting (XSS)

Overview oxidized-web is a puma+sinatra+haml webUI + REST API for oxidized Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper escape of user input provided to the toresearch argument in web/views/confsearch.haml. Details Cross-site scripting or XSS is a...

PT-2022-8300 · Unknown · Ytti Oxidized Web

Name of the Vulnerable Software and Affected Versions: ytti Oxidized Web affected versions not specified Description: A vulnerability was found in ytti Oxidized Web, classified as problematic. The issue affects an unknown function of the file lib/oxidized/web/views/conf search.haml. The...

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.

...

libvirt security, bug fix, and enhancement update

8.5.0-7.0.1 - Set SOURCEDATEEPOCH from changelog Orabug: 32019554 8.5.0-7 - securityselinux: Dont ignore NVMe disks when setting image label rhbz2121441 8.5.0-6 - qemuprocess: Destroy domains namespace after killing QEMU rhbz2121141 8.5.0-5 - rpc: Pass OPENSSLCONF through to ssh invocations...

Malicious Package

Overview conf-dep-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in pm-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46eb261a723ae32c1b00f55fe3fe937ef507ef06a0929fe8ced8adcdd386219e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5378 Malicious code in pm-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46eb261a723ae32c1b00f55fe3fe937ef507ef06a0929fe8ced8adcdd386219e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-23103

A stack-based buffer overflow vulnerability exists in the confsrv confctlsetapplanguage functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

Prototype Pollution

conf-cfg-ini is vulnerable to prototype pollution. A malicious INI file can be parsed and decoded as it does not protect the properties such as "proto" to pollute the global object prototype...

conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...