PT-2022-21942 · Untangle · Untangle

Name of the Vulnerable Software and Affected Versions: untangle versions 1.2.0 and earlier Description: The issue is related to the improper restriction of recursive entity references in DTDs, which can be exploited by a remote unauthenticated attacker to cause a denial-of-service DoS condition o...

[SECURITY] Fedora 35 Update: golang-github-twitchtv-twirp-8.1.0-4.fc35

A simple RPC framework with protobuf service definitions...

[SECURITY] Fedora 35 Update: golang-github-appc-spec-0.8.11-14.fc35

This package contains schema definitions and tools for the App Container app c specification. These include technical details on how an appc image is downloaded over a network, cryptographically verified, and executed on a host. See SPEC.md for details of the specification itself...

[SECURITY] Fedora 36 Update: golang-github-appc-spec-0.8.11-14.fc36

This package contains schema definitions and tools for the App Container app c specification. These include technical details on how an appc image is downloaded over a network, cryptographically verified, and executed on a host. See SPEC.md for details of the specification itself...

CVE-2022-1743

The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS...

CVE-2021-40510

XML eXternal Entity XXE in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs...

MAL-2022-6253 Malicious code in spotify-event-definitions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44be190dc2d81bf8efb26c95572826e1fba0946289786d53a3bb97290bf60b10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spotify-event-definitions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44be190dc2d81bf8efb26c95572826e1fba0946289786d53a3bb97290bf60b10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-QFR5-WJPW-Q4C4 Denial of Service in python-ldap

python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service ReDoS flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this...

Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin

A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management SCM to effectively change the Pipeline...

Sandbox bypass in ontrack Jenkins Plugin

A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM...

GHSA-CJ9J-V8JP-6HM9 Cross-site Scripting in Jenkins Autocomplete Parameter Plugin

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with...

GHSA-R5M8-5MWX-CMJ8 CSRF vulnerability in Config File Provider Plugin

A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions...

GHSA-4P4W-6H54-G885 Improper Input Validation in Apache Santuario XML Security

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service memory consumption via crafted Document Type Definitions DTDs, related to signatures...

Improper Input Validation in Apache Santuario XML Security

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service memory consumption via crafted Document Type Definitions DTDs, related to signatures...

[SECURITY] Fedora 34 Update: golang-github-appc-spec-0.8.11-13.fc34

This package contains schema definitions and tools for the App Container app c specification. These include technical details on how an appc image is downloaded over a network, cryptographically verified, and executed on a host. See SPEC.md for details of the specification itself...

[SECURITY] Fedora 35 Update: golang-github-appc-spec-0.8.11-13.fc35

This package contains schema definitions and tools for the App Container app c specification. These include technical details on how an appc image is downloaded over a network, cryptographically verified, and executed on a host. See SPEC.md for details of the specification itself...

SUSE-RU-2022:1385-1 Recommended update for Salt

This update fixes the following issues: salt: - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil bsc1197533 - Prevent data pollution between actions processed at the same time bsc1197637 - Fix salt-ssh opts poisoning bsc1197637 - Remove duplicated metho...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a4ebbe039 and earlier, except 2.21.3, allows attackers able to submit pull requests or equivalent, but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamicall...