CVE-2022-23457

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...

CVE-2022-23457 Path Traversal in ESAPI

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...

PT-2022-3553

Name of the Vulnerable Software and Affected Versions ESAPI versions prior to 2.3.0.0 Description The default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified parent directory. This potentially...

CVE-2022-23457

ESAPI The OWASP Enterprise Security API is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of Validator.getValidDirectoryPathString, String, File, boolean may incorrectly treat the tested input string as a child of the specified...

OpenSSL DTLS DoS

The vulnerability of the DTLS protocol implementation in the OpenSSL library is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2022-29749

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to the implementation of a timeout for polling status. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...

Java Cryptography Implementation Mistake Allows Digital-Signature Forgeries

Interesting implementation mistake: The vulnerability, which Oracle patched on Tuesday, affects the company’s implementation of the Elliptic Curve Digital Signature Algorithm in Java versions 15 and above. ECDSA is an algorithm that uses the principles of elliptic curve cryptography to authentica...

Ubuntu: Security Advisory (USN-5384-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wrong reweight implementation (ManagedIndexReweightingLogic.sol)

Lines of code Vulnerability details Impact The list of assets will be incorrect after reweight Proof of Concept Base on the doc, updatedAssets is the list of asset for the index after reweight. But the implementation just iterates throw all of the updatedAsset and checks if that weight of asset 0...

USN-5384-1: Linux kernel vulnerabilities

It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference a null pointer in some situations. An attacker could use this to construct a malicious UDF image that, when mounted and operated on, could cause a denial of service system crash. CVE-2022-06...

Users wont be able to withdraw staked tokens since vesting function is called differently in interface and implementation

Lines of code Vulnerability details Impact Users can't withdraw their funds Proof of Concept When withdrawing in staking the contract will send funds to vesting using setupVesting. This is defined in the vesting interface. On the other hand, the vesting implementation calls this function vest so...

Debian DSA-5120-1 : chromium - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5120 advisory. Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure. For the...

Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the 100.0.4896.127 version, fixing many CVE, along with fixes from the 100.0.4896.75 and 100.0.4896.88 versions. Google is aware that an exploit for CVE-2022-1364 exists in the wild. 1315901 High CVE-2022-1364: Type Confusion in V8. Reported...

ALBA-2022:1388 .NET 5.0 on AlmaLinux 8 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET 5.0 to SDK 5.0.213 and Runtime 5.0.16 almalinux-8.5.0.z BZ2072003...

.NET 5.0 on AlmaLinux 8 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET 5.0 to SDK 5.0.213 and Runtime 5.0.16 almalinux-8.5.0.z BZ2072003...

ALBA-2022:1386 .NET Core 3.1 on AlmaLinux 8 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET Core 3.1 to SDK 3.1.418 and Runtime 3.1.24 None8.5.0.z BZ2073450...

.NET Core 3.1 on AlmaLinux 8 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET Core 3.1 to SDK 3.1.418 and Runtime 3.1.24 None8.5.0.z BZ2073450...

ALBA-2022:1383 .NET 6.0 on AlmaLinux 8 bugfix update

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Bug Fixes and Enhancements: Update .NET 6.0 to SDK 6.0.104 and Runtime 6.0.4 None8.5.0.z BZ2073446...

.NET 6.0 on Rocky Linux 8 bugfix update

An update is available for dotnet6.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET Core is a managed-software framework. It implements a subset of the .N...

Microsoft Edge (Chromium) < 100.0.1185.44 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 100.0.1185.44. It is, therefore, affected by multiple vulnerabilities as referenced in the April 15, 2022 advisory. - Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to...