CVE-2022-3282: Authorization Bypass Through User-Controlled Key

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in t...

PT-2022-7342 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 5.18 through 6.0 Description: A use-after-free flaw was found in the Linux kernel MCTP Management Component Transport Protocol functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket...

WordPress Drag and Drop Multiple File Upload plugin <= 1.3.6.4 - File Upload Size Limit Bypass vulnerability

File Upload Size Limit Bypass vulnerability discovered by Sanjay Das in WordPress Drag and Drop Multiple File Upload plugin versions = 1.3.6.4. Solution Update the WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest available version at least 1.3.6.5...

PT-2022-26107 · Tauri · Tauri

Name of the Vulnerable Software and Affected Versions: Tauri versions prior to 1.0.7 Tauri versions prior to 1.1.2 Description: The issue is related to an Incorrectly-Resolved Name, where incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionalit...

GSD-2022-1005305 ath11k: fix missing skb drop on htc_tx_completion error

ath11k: fix missing skb drop on htctxcompletion error This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

PT-2022-33563 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.17 through v5.19.1 Description: The issue is related to a missing skb drop on htc tx completion error in the ath11k module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

Citrix Hypervisor Security Bulletin for CVE-2020-35498

An issue has been identified in Citrix Hypervisor 8.2 LTSR CU1 Hotfix XS82ECU1008 only that may allow malicious network traffic to cause subsequent packets to be dropped. This issue has the following identifier: CVE ID| Description| Type| Pre-requisites ---|---|---|--- CVE-2020-35498| Malicious...

How to configure domain drop-down as the first factor for AAA vserver without nFactor flow.

This article discribe how to configure domain drop-down as the first factor for nFactor auth without nFactor visualizer. The User experience after applied below configuraiton will be like 1. Fist authentication web page 2. 3. After authentication passed, there may prompt second authentication web...

Smap - A Drop-In Replacement For Nmap Powered By Shodan.Io

Smap is a replica of Nmap which uses shodan.io's free API for port scanning. It takes same command line arguments as Nmap and produces the same output which makes it a drop-in replacament for Nmap. Features Scans 200 hosts per second Doesn't require any account/api key Vulnerability detection...

DEBIAN-CVE-2022-36879

An issue was discovered in the Linux kernel through 5.18.14. xfrmexpandpolicies in net/xfrm/xfrmpolicy.c can cause a refcount to be dropped twice...

CVE-2022-36879

An issue was discovered in the Linux kernel through 5.18.14. xfrmexpandpolicies in net/xfrm/xfrmpolicy.c can cause a refcount to be dropped twice...

CVE-2022-36879: Undefined Security Weakness

An issue was discovered in the Linux kernel through 5.18.14. xfrmexpandpolicies in net/xfrm/xfrmpolicy.c can cause a refcount to be dropped twice...

CVE-2021-28511

This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an...

Authorization Bypass

Apache Hive is vulnerable to authorization bypass. The vulnerability exists in the CREATE/DROP operations due to improper restrictions of users privileges which allows an attacker to create and drop UDFs...

[SECURITY] Fedora 35 Update: golang-storj-drpc-0.0.31-2.fc35

Lightweight, drop-in replacement for gRPC...

[SECURITY] Fedora 35 Update: golang-github-pquerna-ffjson-0-0.9.20200730gitaa0246c.fc35

Ffjson generates static MarshalJSON and UnmarshalJSON functions for structures in Go. The generated functions reduce the reliance upon runtime reflection to do serialization and are generally 2 to 3 times faster. In cases where ffjson doesn't understand a Type involved, it falls back to...

GHSA-V3P8-J597-3XG8 Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

Apache Hive before 3.1.3 CREATE and DROP function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users...

CVE-2021-34538

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

CVE-2021-34538

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

Authorization

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...