Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email, and chat rooms. A security vulnerability exists in Discourse versions prior to 2.8.9, 2.9.0.beta9, and 2.9.0.beta9, which stems from a JavaScript error generated by an incomplete...

qdPM 9.1 Authenticated Shell Upload Exploit

A remote code execution vulnerability exists in qdPM versions 9.1 and below. An attacker can upload a malicious PHP code file via the profile photo functionality by leveraging a path traversal vulnerability in the users'photoppreview' delete photo feature thus allowing bypass of .htaccess...

PT-2022-24828 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.9.0.beta5 through 2.9.0.beta9 Description: The issue arises when an incomplete quote generates a JavaScript error, potentially crashing the current page in the browser. This occurs in certain cases and is related to how t...

RHEL 7 : java-1.8.0-ibm (RHSA-2022:6756)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6756 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

CVE-2022-21797

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the predispatch flag in Parallel class due to the eval statement...

OESA-2022-1957 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Contex...

SUSE: Security Advisory (SUSE-SU-2022:3283-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-24814 · Go-Cvss · Go-Cvss

Name of the Vulnerable Software and Affected Versions: go-cvss versions prior to v0.4.0 Description: The issue arises when a full CVSS v2.0 vector string is parsed using the ParseVector function, potentially leading to an Out-of-Bounds Read due to a lack of tests, causing the Go module to panic...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2288)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements if...

hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW)

A flaw was found in hw. Incomplete cleanup in specific special register write operations for some Intel® Processors may allow an authenticated user to enable information disclosure via local access...

hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS)

A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel® Processors may allow an authenticated user to enable information disclosure via local access...

hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW)

A flaw was found in hw. Incomplete cleanup in specific special register write operations for some Intel® Processors may allow an authenticated user to enable information disclosure via local access...

RHEL 8 : kernel-rt (RHSA-2022:6437)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6437 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

RHEL 8 : kernel (RHSA-2022:6460)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6460 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Incomplete cleanup of multi-core share...

Malicious code in dep-incompatible (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb537c14147bd009ef50b49f0aa9e6c60e693c01b44667d8b8ce0e9a295fbbe8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2022:3231-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3231-1 advisory. - CVE-2020-14343: Fixed a arbitrary code execution when processing untrusted YAML files through the fullload method or with the FullLoader...

The vulnerability of the BIOS microprogramming system of Intel Server Platform Services allows a perpetrator to trigger a service failure.

The vulnerability of the BIOS microprogramming system in Intel Server Platform Services is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause service failures...

OracleVM 3.4 : xen (OVMSA-2022-0023)

The remote OracleVM system is missing necessary patches to address security updates: - Incomplete cleanup of multi-core shared buffers for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-21123 - Incomplete cleanup of...

Design/Logic Flaw

A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activated relevant protections too late or no...