GSD-2022-1004310 netfs: gcc-12: temporarily disable '-Wattribute-warning' for now

netfs: gcc-12: temporarily disable '-Wattribute-warning' for now This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

GSD-2022-1004247 mm/memory-failure: disable unpoison once hw error happens

mm/memory-failure: disable unpoison once hw error happens This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.8 by commit...

GHSA-G86G-CHM8-7R2P check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...

PT-2022-23964 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.2.53575 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. Th...

PT-2022-23959 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader version 11.2.1.53537 Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this issue, where the target must visit a malicious pag...

PT-2022-22934 · Unknown · Velociraptor

Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.5-2 Description: The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to...

PT-2022-23605 · Png2Webp · Png2Webp

Name of the Vulnerable Software and Affected Versions: png2webp version 1.0.4 Description: The issue is related to an out-of-bounds write via the function w2p. This can be exploited through a crafted png file. Recommendations: For png2webp version 1.0.4, consider disabling the w2p function until ...

PT-2022-4008 · Jenkins · Jenkins Buckminster Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Buckminster Plugin versions 1.1.1 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Buckminster Plugin, allowing remote attackers with Overall/Read permission to gain unauthorized...

PT-2022-4012 · Jenkins · Jenkins Openstack Heat Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Openstack Heat Plugin versions 1.5 and earlier Description: The issue is related to insufficient authorization procedures in the Jenkins Openstack Heat Plugin, allowing a remote attacker to perform URL redirection. A missing permissio...

PT-2022-5099 · Jenkins · Jenkins Openshift Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier Description: A missing permission check in the Jenkins OpenShift Deployer Plugin allows attackers with Overall/Read permission to check for the existence of an attacker-specified fi...

PT-2022-4024 · Jenkins · Jenkins Coverity Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Coverity Plugin versions 1.11.4 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stor...

PT-2022-4025 · Jenkins · Jenkins Openshift Deployer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenShift Deployer Plugin versions 1.2.0 and earlier Description: The issue is related to a missing permission check in the plugin, which can be exploited by attackers with Overall/Read permission to connect to an attacker-specified U...

CVE-2022-32742

A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file or printer instead of client-supplied data. The client cannot control the area of the...

CVE-2022-2225

By using warp-cli subcommands disable-ethernet, disable-wifi, it was possible for a user without admin privileges to bypass configured Zero Trust security policies e.g. Secure Web Gateway policies and features such as 'Lock WARP switch'...

CVE-2022-2225

By using warp-cli subcommands disable-ethernet, disable-wifi, it was possible for a user without admin privileges to bypass configured Zero Trust security policies e.g. Secure Web Gateway policies and features such as 'Lock WARP switch'...

Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from the US company Cloudflare. A security vulnerability exists in Cloudflare WARP. An attacker can exploit this vulnerability to bypass configured zero-trust security policies e.g., Secure Web Gateway policy and featur...

PT-2022-10249 · Lrzip +1 · Lrzip +1

Name of the Vulnerable Software and Affected Versions: lrzip version 0.641 Description: An issue was discovered in the ucompthread function in stream.c at line 1538, which is a use-after-free. Recommendations: For lrzip version 0.641, consider disabling the ucompthread function as a temporary...

PT-2022-15299 · Warp · Warp

Name of the Vulnerable Software and Affected Versions: WARP affected versions not specified Description: The issue allows a user without admin privileges to bypass configured Zero Trust security policies, such as Secure Web Gateway policies, and features like 'Lock WARP switch' by utilizing...

PT-2022-10197 · Tencent · Qq

Name of the Vulnerable Software and Affected Versions: QQ application version 8.7.1 Description: The issue concerns the QQ application's failure to enforce permission requirements for determining a device's physical location, such as android.permission.ACCESS FINE LOCATION. An attacker can exploi...

PT-2022-5112 · Assimp +2 · Assimp +2

Name of the Vulnerable Software and Affected Versions: Open Asset Import Library Assimp versions prior to the version containing the fix for the segmentation violation in Assimp::XFileImporter::CreateMeshes Description: The issue is related to a segmentation violation in the...