GSD-2022-1005467 kbuild: dummy-tools: avoid tmpdir leak in dummy gcc

kbuild: dummy-tools: avoid tmpdir leak in dummy gcc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1005135 kbuild: dummy-tools: avoid tmpdir leak in dummy gcc

kbuild: dummy-tools: avoid tmpdir leak in dummy gcc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

GSD-2022-1005070 kbuild: dummy-tools: avoid tmpdir leak in dummy gcc

kbuild: dummy-tools: avoid tmpdir leak in dummy gcc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit...

PT-2022-33393 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue is related to a potential security vulnerability in the Linux Kernel, specifically in the kbuild dummy-tools component. It involves avoiding a tmpdir leak in dummy gcc. The actual...

check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...

GHSA-G86G-CHM8-7R2P check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...

MAL-2022-5429 Malicious code in postinstall-dummy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 652042e2c25b6583777de6cdf0e4beeaaa9bb3e1a1114ca94840dae3e7a4715d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in postinstall-dummy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 652042e2c25b6583777de6cdf0e4beeaaa9bb3e1a1114ca94840dae3e7a4715d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview dummyapp is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in dummy_app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f530f5bb0e82113a96ed98f099daad77e0a9de832579a859b651a1875a86525 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

new packages: xorg-x11-drv-dummy

An update is available for xorg-x11-drv-dummy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Malicious code in dummy-preprocessor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4908ea8244b5d2d0dad36068c074f34b17b6302ce6108fc1526b398a21613794 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2609 Malicious code in dummy-preprocessor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4908ea8244b5d2d0dad36068c074f34b17b6302ce6108fc1526b398a21613794 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Reentrancy in depositBribeERC20 function

Lines of code Vulnerability details Impact depositBribeERC20 function in BriveVault is reentrant in line 187, where an address supplied by the caller is called. A bad actor that has DEPOSITORROLE and is a contract can execute a folowing attack: 1. Create a dummy token contract, reentrant in the...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4shell4shell Log4j - Multitool. Find & fix possible CVE...

SUSE: Security Advisory (SUSE-SU-2018:2842-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gogs Git Hooks Remote Code Execution Exploit

This Metasploit module leverages an insecure setting to get remote code execution on the target OS in the context of the user running Gogs. This is possible when the current user is allowed to create git hooks, which is the default for administrative users. For non-administrative users, the...

CVE-2020-26230

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and...

Design/Logic Flaw

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and...

kernel: bpf: Fix KASAN use-after-free Read in compute_effective_progs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KASAN use-after-free Read in computeeffectiveprogs Syzbot found a Use After Free bug in computeeffectiveprogs. The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling...