Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in table-row parsing, when parsing marker rows that contain more than UINT16MAX columns. Note If affected versions are used for rendering remote user-controlled markdown, this vulnerability may lead to...

DEBIAN-CVE-2022-24724

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:rowfromstring may lead to heap memory corruption when parsing tables who's marker rows contain mor...

UBUNTU-CVE-2022-24724

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing table.c:rowfromstring may lead to heap memory corruption when parsing tables who's marker rows contain mor...

PT-2022-7621 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fix in commit 5f394102ee27dbf05la4e283390cd8d1759dacea Description: The vulnerability is related to a null pointer dereference in the com20020pci probe function during driver initialization. The issue arises...

PT-2022-4363 · Frrouting +3 · Frrouting +3

Name of the Vulnerable Software and Affected Versions: FRRouting versions through 8.1.0 Description: The issue is related to buffer overflow vulnerabilities due to incorrect checks on the subtlv length in the functions parse hello subtlv, parse ihu subtlv, and parse update subtlv in...

WordPress WooCommerce Disable Payment Methods based on cart conditions plugin < 1.13.1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce Disable Payment Methods based on cart conditions plugin versions 1.13.1.1. Solution Update the WordPress WooCommerce Disable Payment Methods based on cart conditions plugin to the latest...

WordPress WP Disable Sitemap plugin < 1.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Disable Sitemap plugin versions 1.0.4. Solution Update the WordPress WP Disable Sitemap plugin to the latest available version at least 1.0.4...

WordPress WP Disable Sitemap plugin < 1.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Disable Sitemap plugin versions 1.0.4. Solution Update the WordPress WP Disable Sitemap plugin to the latest available version at least 1.0.4...

PT-2022-7480 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc4-next-20220217+ Description: The issue is related to a use-after-free vulnerability in the blktrace component of the Linux kernel. This vulnerability can be triggered when tracing the whole disk, and...

GSD-2022-1000655 btrfs: fix deadlock between quota disable and qgroup rescan worker

btrfs: fix deadlock between quota disable and qgroup rescan worker This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.8 by commit...

PT-2022-2556 · Atlassian · Bitbucket

Name of the Vulnerable Software and Affected Versions: Atlassian Bitbucket Data Center versions 5.14.0 through 7.6.13 Atlassian Bitbucket Data Center versions 7.7.0 through 7.17.5 Atlassian Bitbucket Data Center versions 7.18.0 through 7.18.3 Atlassian Bitbucket Data Center versions 7.19.0 throug...

PT-2022-12314 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.2.3 and below Description: The "Trigger DAG with config" screen in Apache Airflow is susceptible to XSS attacks via the origin query argument. Recommendations: For Apache Airflow versions 2.2.3 and below, consider...

PT-2022-15683 · Cybonet · Pineapp Mail Relay

Name of the Vulnerable Software and Affected Versions: Cybonet - PineApp Mail Relay affected versions not specified Description: The issue concerns an unauthenticated SQL injection vulnerability. An attacker can send a request to specific API endpoints, such as...

PT-2022-7630 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc1-00233-g9a20c48d1ed2 Description: The issue is related to the riscv component of the Linux kernel, where the trace hardirqs on,off functions require the caller to set up the frame pointer properly. If...

PT-2022-9421 · Npm +4 · @Braintree/Sanitize-Url +4

Name of the Vulnerable Software and Affected Versions: @braintree/sanitize-url versions prior to 6.0.0 Description: The issue is related to Cross-site Scripting XSS due to improper sanitization in the sanitizeUrl function. This allows for potential XSS attacks. Recommendations: For versions prior...

GSD-2022-1000170 btrfs: fix deadlock between quota disable and qgroup rescan worker

btrfs: fix deadlock between quota disable and qgroup rescan worker This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.178 by commit...

PT-2022-17210 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered that could lead to XSS in the bookmarks component. Recommendations: For versions through 1.4, as a temporary workaround, consider disabling the bookmarks component until a...

PT-2022-1643

Name of the Vulnerable Software and Affected Versions Redis versions prior to the fixed version Debian-specific Redis Server affected versions not specified Description A Lua sandbox escape vulnerability in Redis could result in remote code execution. The issue is related to a packaging problem a...

PT-2022-17207 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered where endpoints could be open even when not enabled. Recommendations: For versions through 1.4, consider disabling endpoints that are not in use to minimize the risk of...

PT-2022-17218 · Unknown · Rigoblock Dragos

Name of the Vulnerable Software and Affected Versions: RigoBlock Dragos through 2022-02-17 Description: The issue is related to the lack of the onlyOwner modifier for setMultipleAllowances, which enables token manipulation. This has been exploited in the wild in February 2022. A major protocol...