Denial Of Service (DoS)

IBM MQ is vulnerable to denial of service. The vulnerability exists due to a lack of sanitization of user access allowing an attacker to fill up the disk space of the underlying filesystem using the error logging service...

CVE-2022-23626 Insufficient file checks in m1k1o/blog

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload function returned false, the original file that could contain a malicious payload was kept on the disk. Use...

CVE-2022-23626: Improper Input Validation

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload function returned false, the original file that could contain a malicious payload was kept on the disk. Use...

PT-2022-16140 · Unknown · M1K1O/Blog

Name of the Vulnerable Software and Affected Versions: m1k1o/blog affected versions not specified Description: The issue concerns a lightweight self-hosted PHP blog, where errors from functions imagecreatefrom and image have not been checked properly. Although PHP issued warnings and the upload...

CVE-2022-24552: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with roo...

PT-2022-16715 · Starwind · Starwind Stack +1

Name of the Vulnerable Software and Affected Versions: StarWind SAN and NAS version 0.2 build 1633 Description: A flaw was found in the REST API in StarWind Stack, where the REST command that manipulates a virtual disk does not check input parameters. Some of these parameters are directly execute...

CVE-2022-23565

Tensorflow is an Open Source Machine Learning Framework. An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on...

Google TensorFlow security vulnerabilities

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow that could be exploited to trigger a denial of service by changing the SavedModel on disk...

MGASA-2022-0047 Updated cryptsetup packages fix security vulnerability

An attacker can modify on-disk metadata to simulate decryption in progress with crashed unfinished reencryption step and persistently decrypt part of the LUKS device CVE-2021-4122...

[SECURITY] Fedora 34 Update: glibc-2.33-21.fc34

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

cryptsetup security update

An update for cryptsetup is now available for Rocky Linux 8. Rocky Linux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Moderate: Red Hat Security Advisory: cryptsetup security update

An update for cryptsetup is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RLSA-2022:0370 Moderate: cryptsetup security update

The cryptsetup packages provide a utility for setting up disk encryption using the dm-crypt kernel module. Security Fixes: cryptsetup: disable encryption via header rewrite CVE-2021-4122 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

clevis bug fix and enhancement update

Clevis is a pluggable framework for automated decryption. It can be used to provide automated decryption of data or even automated unlocking of LUKS volumes. The clevis packages provide the client side of the Network Bound Disk Encryption NBDE project. Bug Fixes and Enhancements: Server hangs in...

PT-2022-1002

Name of the Vulnerable Software and Affected Versions Clevis affected versions not specified Description The issue concerns Clevis, a pluggable framework for automated decryption, which can be used for automated decryption of data or unlocking of LUKS volumes. It is part of the Network Bound Disk...

QEMU: block: fdc: null pointer dereference may lead to guest crash

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulti...

Shlayer and Bundlore MacOS Malware Strains – How Uptycs EDR Detection Can Help

Adware strains Shlayer and Bundlore are the most common malware in macOS – although they have slight variations, they have long invaded and bypassed Xprotect, Notarization, Gatekeeper, and File Quarantine, all security features pre-built into macOS. The Uptycs threat research team has tracked the...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Podman_Project Podman

CVE-2021-4034-Rust Linux LPE using polkit-1 written in Rust...

[SECURITY] Fedora 34 Update: cryptsetup-2.3.7-1.fc34

The cryptsetup package contains a utility for setting up disk encryption using dm-crypt kernel module...

SUSE SLED15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-pa / etc (SUSE-SU-2022:0177-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0177-1 advisory. - CVE-2021-20196: Fixed null pointer dereference that may lead to guest crash bsc1181361. Tenable has extracted the...