SUSE: Security Advisory (SUSE-SU-2022:4284-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome that stems from insufficient policy enforcement in DevTools. An attacker convinces users to install malicious extensions in order to bypass navigation restrictions via a crafted Chrome extension...

Unspecified Vulnerability in Google Chrome (CNVD-2022-86350)

Google Chrome is a web browser from Google, an American company. Google Chrome version 108.0.5359.71 prior to release for use in Mojo has a security vulnerability that can be exploited by an attacker to launch an attack by tricking a user into installing a malicious extension and exploiting heap...

Google Chrome < 108.0.5359.71 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 108.0.5359.71. It is, therefore, affected by multiple vulnerabilities as referenced in the 202211stable-channel-update-for-desktop29 advisory. - Use after free in Accessibility in Google Chrome prior to 108.0.5359.71...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 28 security fixes, including: 1379054 High CVE-2022-4174: Type Confusion in V8. Reported by Zhenghang Xiao @Kipreyyy on 2022-10-27 1381401 High CVE-2022-4175: Use after free in Camera Capture. Reported by Leecraso and Guang Gong of 360 Alpha Lab on...

CVE-2022-4177

CVE-2022-4177 : Use-after-free in Chrome extensions; vulnerable as of Chrome/Chromium before 108.0.5359.71. An attacker who persuades a user to install a crafted extension via UI interaction could exploit heap corruption. The Chrome stable release 108.0.5359.71 and related Chromium fixes address ...

Google Chrome < 108.0.5359.71 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 108.0.5359.71. It is, therefore, affected by multiple vulnerabilities as referenced in the 202211stable-channel-update-for-desktop29 advisory. - Use after free in Accessibility in Google Chrome prior to 108.0.5359.71...

VulnCheck KEV: CVE-2022-34721

Windows Internet Key Exchange IKE Protocol Extensions Remote Code Execution Vulnerability...

Use After Free

chromium is vulnerable to use-after free. The vulnerability exists in Extensions in Google Chrome which allows an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension...

Information Disclosure

chromium is vulnerable to information disclosure. The vulnerability exists due to insufficient data validation in Extensions in Google Chrome which allows a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension...

hw: cpu: information disclosure via Intel Software Guard Extensions (SGX) Platform

A flaw was found in hw. Sensitive information accessible by physical probing of the JTAG interface for some IntelR Processors with SGX may allow an unprivileged user to disclose information via physical access...

gnome-shell-extensions bug fix and enhancement update

An update is available for gnome-shell-extensions. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

PT-2022-35158 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.14 through v6.0.2 Description: The issue is related to the arm64 architecture and Memory Tagging Extensions MTE in the Linux Kernel. It involves avoiding the setting of PG mte tagged if no tags are cleared or restored...

CVE-2022-3510

CVE-2022-3510 summary and remediation (connected sources) : A parsing issue in protobuf-java core and lite triggers a denial-of-service when inputs contain multiple non-repeated embedded messages with repeated/unknown fields, causing objects to flip between mutable and immutable forms and potenti...

CVE-2022-3510

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown...

OESA-2022-2093 rubygem-websocket-extensions security update

Generic extension manager for WebSocket connections. Security Fixes: websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content ...

PT-2022-18457 · Intel · Intel Sgx Sdk

Name of the Vulnerable Software and Affected Versions: IntelR SGX SDK software affected versions not specified Description: The issue is related to the premature release of a resource during its expected lifetime, which may allow a privileged user to potentially enable information disclosure via...

Intel SGX SDK 安全漏洞

Intel SGX SDK is a set of software development kits based on SGX Intel Software Security Extensions technology from Intel Corporation USA. A security vulnerability exists in the Intel SGX SDK software that stems from prematurely releasing resources, which could allow a privileged user to...

CVE-2022-40797

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDENUPLOADS value in conf.json only blocks .php, .php4, and .php5 files. Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations...

Vulnerability of browser extensions in Google Chrome and Microsoft Edge, allowing attackers to gain unauthorized access to protected information

The vulnerability of Google Chrome and Microsoft Edge browser extensions is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by downloading a specially created extension...