CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

CVE-2022-29911

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

SUSE SLES12 Security Update : kernel (Live Patch 25 for SLE 12 SP4) (SUSE-SU-2022:4595-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4595-1 advisory. This update for the Linux Kernel 4.12.14-9593 fixes several issues. The following security issues were fixed: - CVE-2022-43945: Fixed a buffer...

Wrong implemention of ERC721TokenReceiver interface leads to incorrect collateral ownership and NFT loss

Lines of code Vulnerability details Impact To add a collateral, one could send the NFT directly to the contract, onERC721Received is called then to handle adding the collateral to the vault. However, if the user sends the NFT via an operator then the ownership of the collateral will be assigned t...

SUSE SLES15 Security Update : kernel (Live Patch 23 for SLE 15 SP3) (SUSE-SU-2022:4544-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4544-1 advisory. This update for the Linux Kernel 5.3.18-1503005990 fixes several issues. The following security issues were fixed: - CVE-2022-43945: Fixed a...

SUSE SLES15 Security Update : kernel (Live Patch 5 for SLE 15 SP4) (SUSE-SU-2022:4542-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4542-1 advisory. This update for the Linux Kernel 5.14.21-1504002433 fixes several issues. The following security issues were fixed: - CVE-2022-43945: Fixed a...

SUSE SLES12 Security Update : kernel (Live Patch 37 for SLE 12 SP5) (SUSE-SU-2022:4510-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4510-1 advisory. This update for the Linux Kernel 4.12.14-122139 fixes several issues. The following security issues were fixed: - CVE-2022-43945: Fixed a buffe...

[NAZ-M1] fulfillRandomWords() Must Not Revert

Lines of code Vulnerability details Impact In the current implementation of fulfillRandomWords can revert which it is not supposed to. Proof of Concept In the Chainlink documentation it states: "If your fulfillRandomWords implementation reverts, the VRF service will not attempt to call it a secon...

Wrong update of stoploss in TradingExtension._limitClose()

Lines of code Vulnerability details Impact TradingExtension.limitClose returns a wrong stoploss which is favorable for users and it would be a significant loss for the protocol. Proof of Concept TradingExtension.limitClose is used to set takeprofit/stoploss prices for the pending order and execut...

CVE-2021-4226

RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented...

chbrown rfc6902 安全漏洞

rfc6902 is an implementation of rfc6902 in TypeScript by the individual developer Christopher Brown. A security vulnerability exists in chbrown rfc6902, which stems from the fact that incorrect operation can lead to prototype contamination...

.NET 7.0 bugfix update

An update is available for dotnet7.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...

.NET 6.0 bugfix update

An update is available for dotnet6.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...

SUSE SLES12 Security Update : containerd (SUSE-SU-2022:4409-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4409-1 advisory. Update to containerd v1.6.12 including Docker v20.10.21-ce bsc1206065. Also includes the following fix: - CVE-2022-23471: host memo...

Ubuntu: Security Advisory (USN-5773-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Spoofing Attacks

chromium is vulnerable to spoofing attacks. Inappropriate implementation of Navigation allows a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page...

CVE-2022-23471 containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, f...

CVE-2022-23471 containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, f...

containerd 资源管理错误漏洞

containerd is an industry-standard container runtime open-sourced by containerd. A resource management error vulnerability exists in containerd versions prior to 1.6.12, 1.5.16, and prior to 1.5.16. The vulnerability stems from a bug found in containerd's CRI implementation, which can be exploite...

Chromium: CVE-2022-4182 Inappropriate implementation in Fenced Frames

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...