GSD-2022-1006384 sched/debug: fix dentry leak in update_sched_domain_debugfs

sched/debug: fix dentry leak in updatescheddomaindebugfs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.68 by commit...

GSD-2022-1006377 sch_sfb: Don't assume the skb is still around after enqueueing to child

schsfb: Don't assume the skb is still around after enqueueing to child This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.68 by commit...

GSD-2022-1006372 erofs: fix pcluster use-after-free on UP platforms

erofs: fix pcluster use-after-free on UP platforms This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.68 by commit...

GSD-2022-1006370 RDMA/irdma: Report the correct max cqes from query device

RDMA/irdma: Report the correct max cqes from query device This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.68 by commit...

GSD-2022-1006366 cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()

cgroup: Add missing cpusreadlock to cgroupattachtaskall This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.70 by commit...

GSD-2022-1006359 drm/radeon: add a force flush to delay work when radeon

drm/radeon: add a force flush to delay work when radeon This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...

GSD-2022-1006354 vfio/type1: Unpin zero pages

vfio/type1: Unpin zero pages This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit 5d721bf222936f5cf3ee15ced53cc483ecef7e46. For mor...

GSD-2022-1006345 tee: fix compiler warning in tee_shm_register()

tee: fix compiler warning in teeshmregister This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...

GSD-2022-1006331 swiotlb: avoid potential left shift overflow

swiotlb: avoid potential left shift overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...

ZKSecurity BIO 4.1.2 SQL Injection / Code Execution

ADVISORY INFORMATION Product: ZKSecurity BIO Vendor: ZKTeco https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurityV50004.1.2 Version Affected: 4.1.2 CVE: CVE-2022-36635 Vulnerability: SQL Injection with a plus: RCE CREDIT This vulnerability was discovered and researched by Caio Burgardt and Silton...

CVE-2020-15333

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select from Administratorusers" and "select from Usersusers" requests...

CVE-2020-15333

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select from Administratorusers" and "select from Usersusers" requests...

Dismantling a Prolific Cybercriminal Empire: REvil Arrests and Reemergence

Dismantling a Prolific Cybercriminal Empire: REvil Arrests and Reemergence By John Fokker · September 29, 2022 We’ve recently seen reports that the REvil ransomware gang is back online after the January 2022 arrests of several its members by Russian authorities claiming to dismantle the group and...

USN-5587-1: curl vulnerability | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Axel Chong discovered that when curl accepted and sent back cookies containing control bytes that a HTTPS server might return a 400 Bad Request Error response. A malicious cookie host...

CVE-2022-40082

Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function...

Malicious Package

Overview nonexistantpackageasdfgh is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Netfilter nft_set_elem_init Heap Overflow Privilege Escalation Exploit

An issue was discovered in the Linux kernel through version 5.18.9. A type confusion bug in nftseteleminit leading to a buffer overflow could be used by a local attacker to escalate privileges. The attacker can obtain root access, but must start with an unprivileged user namespace to obtain...

Nepxion Discovery Remote Code Execution Vulnerability

Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...

Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in the IBM InfoSphere Discovery Information Center (CVE-2012-2159, CVE-2012-2161)

Abstract Security Bulletin: Open Redirect and Cross-Site Scripting Vulnerabilities in the IBM InfoSphere Discovery Information Center CVE-2012-2159, CVE-2012-2161 Content SUMMARY: The InfoSphere Discovery Information Center package gives you local access to all of the information you need to take...

Security Bulletin: Vulnerability IBM Java XML Parser used in IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed (CVE-2013-4002)

Abstract IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed ships with IBM Java JRE. This JRE contains a variant of Apache-J XML parser XM4J that is vulnerable to a denial of service attack triggered by malformed XML data. Content CVE ID: CVE-2013-4002 IBM CVSS SCORE: 7.1CVSS...