CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...

UBUNTU-CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...

Information disclosure

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...

CVE-2022-1227

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to...

Fedora: Security Advisory for golang-github-google-slothfs (FEDORA-2022-5cbd6de569)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-intel-goresctrl (FEDORA-2022-3a63897745)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Arbitrary filesystem write access from velocity.

Impact The velocity scripts is not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Now writing an attacking script in velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which...

GHSA-CVX5-M8VG-VXGC Arbitrary filesystem write access from velocity.

Impact The velocity scripts is not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Now writing an attacking script in velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which...

[SECURITY] Fedora 34 Update: golang-github-intel-goresctrl-0.2.0-4.fc34

Golang library for managing resctrl filesystem...

[SECURITY] Fedora 34 Update: golang-github-containerd-continuity-0.2.2-2.fc34

A transport-agnostic, filesystem metadata manifest system...

[SECURITY] Fedora 34 Update: golang-github-google-slothfs-0-0.10.20200727git59c1163.fc34

SlothFS is a FUSE filesystem that provides light-weight, lazily downloaded, read-only checkouts of manifest-based Git projects. It is intended for use wi th Android...

[SECURITY] Fedora 35 Update: golang-github-google-slothfs-0-0.10.20200727git59c1163.fc35

SlothFS is a FUSE filesystem that provides light-weight, lazily downloaded, read-only checkouts of manifest-based Git projects. It is intended for use wi th Android...

[SECURITY] Fedora 35 Update: golang-github-intel-goresctrl-0.2.0-4.fc35

Golang library for managing resctrl filesystem...

[SECURITY] Fedora 35 Update: golang-github-containerd-continuity-0.2.2-2.fc35

A transport-agnostic, filesystem metadata manifest system...

SUSE SLES12: kgraft-patch-4_4_180-94_144-default / etc (SUSE-SU-2022:1440-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1440-1 advisory. This update for the Linux Kernel 4.4.180-94144 fixes several issues. The following security issues were fixed: - CVE-2022-1016: Fix...

workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries does not restrict the names of resources passed to the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system...

SUSE SLES12 / SLES15 Security Update : kernel (Live Patch 21 for SLE 12 SP5) (SUSE-SU-2022:1335-1)

The remote SUSE Linux SLES12 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1335-1 advisory. - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write. This flaw allows...

SUSE SLES12 / SLES15 Security Update : kernel (Live Patch 21 for SLE 12 SP4) (SUSE-SU-2022:1329-1)

The remote SUSE Linux SLES12 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1329-1 advisory. - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel CVE-2021-39713 - A...

Race condition

The Tatsu WordPress plugin before 3.3.12 addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control...

CVE-2021-25094 Tatsu < 3.3.12 - Unauthenticated RCE

The Tatsu WordPress plugin before 3.3.12 addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control...