UBUNTU-CVE-2022-31744

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

The vulnerability of the virtual learning environment Moodle, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability in the virtual learning environment Moodle is related to the lack of measures taken to protect the structure of the web page when using user identification numbers. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially...

SUSE-SU-2022:1846-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode and SEV firmware - CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,...

SUSE-SU-2022:1840-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode and SEV firmware - CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,...

PT-2022-14154 · Linux Mint +1 · Linuxmint +1

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific issue. It appears to be related to the management of vulnerability identifiers, indicating that one...

The vulnerability in the implementation of the configuration comparison function of the command-line utility cURL allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the configuration comparison function in the cURL command-line utility is related to insufficient protection of service data when working with the IPv6 protocol. Exploiting this vulnerability can allow a remote attacker to establish an incorrect connection, where one...

CVE-2022-24611

Denial of Service DoS in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs...

uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.

...

Zend Framework CSRF Vulnerability

Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...

GHSA-GWWQ-54QP-9PGP Zend Framework CSRF Vulnerability

Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...

GHSA-44PR-MGCP-V36R SimpleSAMLphp Unauthenticated encryption in CBC mode

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

SimpleSAMLphp Unauthenticated encryption in CBC mode

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

GHSA-Q7WX-MHX4-JR8Q Apache Wicket Sensitive Data Exposure

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions...

GHSA-FPG6-XQJ4-J7WF Jenkins Jira Plugin Incorrect Authorization vulnerability

An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing...

The vulnerability of the C language programming library uClibc and uClibc-ng lies in the possibility of using predictable transaction identifiers during DNS requests, allowing a hacker to redirect users to arbitrary websites.

The vulnerability of the C language programming library uClibc and uClibc-ng lies in the ability to use predictable transaction identifiers during DNS requests. Exploiting this vulnerability allows a malicious actor to send specially crafted DNS packets, thereby causing the DNS cache to store...

DEBIAN-CVE-2022-30295

uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2...

GHSA-JG2X-R643-W2CH Jetty Uses Predictable Session Identifiers

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possib...

curl 资源管理错误漏洞

curl is a tool used to transfer data from or to a server. A resource management error vulnerability exists in curl that stems from a logical error in the configuration matching feature that does not take into account IPv6 address region ids. This issue could cause curl to reuse the wrong connecti...

USN-5388-1: OpenJDK vulnerabilities

It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could possibly use this issue to cause a denial of service. CVE-2022-21426 It was discovered that OpenJDK incorrectly handled converting certain object arguments into their...

OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit...