OpenCats SQL injection vulnerability

OpenCats is an open source recruitment process management system. OpenCats v0.9.6 suffers from a SQL injection vulnerability that stems from a security issue with the entriesPerPage variable. No details of the vulnerability are provided at this time...

PT-2022-26705 · Opencats · Opencats

Name of the Vulnerable Software and Affected Versions: OpenCATS version 0.9.6 Description: A SQL injection issue was found in OpenCATS via the entriesPerPage variable. This allows for potential exploitation. Recommendations: For OpenCATS version 0.9.6, avoid using the entriesPerPage variable unti...

PT-2022-5240

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 106 Firefox ESR versions prior to 102.4 Thunderbird versions prior to 102.4 Description A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via...

OESA-2022-1994 dovecot security update

Dovecot is an IMAP server for Linux/UNIX-like systemsa wrapper package that will just handle common things for all versioned dovecot packages. Security Fixes: An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the...

CVE-2022-35914

creationtimestamp| type| source ---|---|--- 2022-10-04 11:01:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6910 2022-10-10 16:30:23+00:00| published-proof-of-concept| https://t.me/MrVGunz/553 2022-10-11 16:30:21+00:00| published-proof-of-concept|...

PT-2022-34627 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.68 Description: The issue concerns the RDMA/irdma component, where it fails to report the correct max cqes from query device. This problem was introduced in version v5.14 and is fixed in Linux Kernel versi...

OESA-2022-1968 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition unmapmappingrange versus munmap, a device driver can free a page while it still has stale TLB entries. This only...

SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:3422-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3422-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

SSH Buffer Overflow DoS

The vulnerability of SSH clients and server-side networking frameworks like Twisted relates to the ability to accept an infinite number of data entries for the SSH version identifier. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

CVE-2022-39188

A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries. Mitigation Mitigation for this issue is either not available or the currently available...

SUSE SLES15: kernel-livepatch-4_12_14-150000_150_95-default / etc (SUSE-SU-2022:3406-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:3406-1 advisory. This update for the Linux Kernel 4.12.14-15000015095 fixes one issue. The following security issue was fixed: - CVE-2022-39188: Fixed a race condition...

SUSE SLES12: kgraft-patch-4_12_14-95_105-default / etc (SUSE-SU-2022:3346-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:3346-1 advisory. This update for the Linux Kernel 4.12.14-95105 fixes one issue. The following security issue was fixed: - CVE-2022-39188: Fixed a race condition betwee...

Over 39,000 Unauthenticated Redis Instances Found Exposed on the Internet

An unknown attacker targeted tens of thousands of unauthenticated Redis servers exposed on the internet in an attempt to install a cryptocurrency miner. It's not immediately known if all of these hosts were successfully compromised. Nonetheless, it was made possible by means of a "lesser-known...

PT-2024-7887 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL pointer dereference in the Linux kernel's gpio component. This occurs when removing debugfs entries while unbinding the driver, causing a NULL-pointer...

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

...

WordPress Plugin Sucuri Security has a vulnerability related to cross-site request forgery.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2022-19654 · WordPress · Sucuri Security

Name of the Vulnerable Software and Affected Versions: Sucuri Security plugin versions prior to 1.8.34 Description: A Cross-Site Request Forgery CSRF issue exists, allowing for the creation of Event log entries. Recommendations: For versions prior to 1.8.34, update to version 1.8.34 or later to...

Malicious Package

Overview has-bin-entries is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious code in has-bin-entries (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dba5e25de7a276690ce5b73aa657d8f8ef53dfcc54f531205cdb92069886e818 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3565 Malicious code in has-bin-entries (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dba5e25de7a276690ce5b73aa657d8f8ef53dfcc54f531205cdb92069886e818 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...