Mageia: Security Advisory (MGASA-2020-0342)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-V26W-GCXH-V4R7 Prototype polluation in just-safe-set

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution...

Prototype polluation in just-safe-set

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution...

fusion-plugin-jwt (>=0.1.0, <=0.1.8), toystore (>=1.1.1, <=1.5.3) potentially affected by CVE-2021-25952 via just-safe-set (1.1.0)

just-safe-set NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on just-safe-set and may be impacted: - fusion-plugin-jwt =0.1.0, =1.1.1, =1.5.3 Source cves: CVE-2021-25952 Source advisory: OSV:GHSA-V26W-GCXH-V4R7...

Command injection in git-it-electron

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name which is not sanitized for execution...

CVE-2021-44685

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name which is not sanitized for execution...

CVE-2021-44685

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name which is not sanitized for execution...

pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454...

pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454...

just-great-software.com Cross Site Scripting vulnerability OBB-2152274

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

USN-5086-1 linux, linux-hwe, linux-hwe-5.11, linux-hwe-5.4 vulnerability

Johan Almbladh discovered that the eBPF JIT implementation for IBM s390x systems in the Linux kernel miscompiled operations in some situations, allowing circumvention of the BPF verifier. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...

Stack overflow

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairin...

DEBIAN-CVE-2021-39536

An issue was discovered in libxsmm through v1.16.1-93. The JIT code has a heap-based buffer overflow...

CVE-2021-39536

An issue was discovered in libxsmm through v1.16.1-93. The JIT code has a heap-based buffer overflow...

Libxsmm 代码问题漏洞

Libxsmm is a library. for specialized dense and sparse matrix operations as well as deep learning primitives e.g., small convolutions. A security vulnerability exists in libxsmm that stems from the presence of a null pointer dereference in JIT code. It allows an attacker to cause a denial of...

Libxsmm 缓冲区错误漏洞

Libxsmm is a library. for specialized dense and sparse matrix operations as well as deep learning primitives e.g., small convolutions. A security vulnerability exists in libxsmm that stems from JIT code having a heap-based buffer overflow...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that can be exploited by an attacker to run code through the MIPS CBPF JIT compiler branch instruction...

Update now! Google Chrome fixes two in-the-wild zero-days

Google announced on Monday that it will be issuing patches for 11 high severity vulnerabilities found in Chrome, including two that are currently being exploited in the wild. The patch, which is part of the Stable Channel Update for Chrome 93 93.0.4577.82, will be released for Windows, Mac, and...

CVE-2021-36302

All Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A remote malicious user with standard level JEA credentials may potentially exploit this vulnerability to elevate privileges and take over the system...

kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation

A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this...