CVE-2023-20915

In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

CVE-2022-3924

This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clien...

Design/Logic Flaw

This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clien...

CVE-2022-3924

This issue can affect BIND 9 resolvers with "stale-answer-enable yes;" that also make use of the option "stale-answer-client-timeout", configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of...

CVE-2022-3924

CVE-2022-3924 is a vulnerability in ISC BIND where stale-answer-client-timeout (enabled with a positive value) can cause a race between returning a stale answer and an early SERVFAIL, potentially triggering an assertion failure and DoS. Affected are BIND 9.16.12–9.16.36, 9.18.0–9.18.10, 9.19.0–9....

CVE-2022-3924

This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clien...

grub2 security update

2.02-142.0.3.el87.1 - Fix CVE-2022-3775, CVE-2022-2601 Orabug: 34867710 - Bump SBAT metadata for grub to 3 Orabug: 34871758 - Enable signing on aarch64 - Don't try to switch to a BLS config if GRUBENABLEBLSCFG is already set Javier Martinez Canillas Orabug: 34375996 - Enable back btrfs module by...

CVE-2022-3924: Reachable Assertion

This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clien...

PT-2023-33965

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.87 Description The issue is related to a use-after-free error in the qlcnic dcb enable function. This error occurs when the qlcnic dcb enable function fails, potentially leading to a security issue. The...

PT-2023-34330

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description The issue is related to a use-after-free error in the qlcnic dcb enable function. This error occurs when the qlcnic dcb enable function fails, potentially leading to a security issue. The...

PT-2023-33500 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue is related to a use-after-free error in the qlcnic dcb enable function. This error occurs when the qlcnic dcb enable function fails, potentially leading to a security issue. The...

PT-2023-33856

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description The issue is related to the drm: lcdif: Set and enable FIFO Panic threshold. It was introduced in version v6.0 and fixed in version v6.0.16. The actual impact and attack plausibility have not...

Microsoft Windows BitLocker 安全漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. A security vulnerability exists in Microsoft Windows BitLocker that stems from the presence of a security feature bypass vulnerability...

PT-2022-7518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the workqueue enabling process in the Linux kernel. When the driver is removed, it assumes that the workqueue was enabled successfully and attempts to free...

Dahua software products 授权问题漏洞

Dahua software products are a family of applications from Dahua Corporation of China. A security vulnerability exists in several Dahua software products, which originates from an unauthenticated attacker being able to enable or disable SSHD services by sending specific, carefully crafted packets ...

PT-2025-37590

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the qlcnic driver where a use-after-free condition can occur during DCB Data Center Bridging operations. Specifically, the adapter-dcb pointer could b...

Download Manager < 3.2.62 - Contributor+ Stored XSS

The plugin does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. 1. “Enable modal login form” option in the...

CVE-2022-43486

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices...

PT-2022-26938 · Buffalo · Buffalo Network Devices

Name of the Vulnerable Software and Affected Versions: Buffalo network devices affected versions not specified Description: A hidden functionality issue in Buffalo network devices allows an attacker with administrative privileges to enable debug functionalities and execute arbitrary commands on t...

CVE-2022-20501

In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for...