Jenkins Deployer Framework Plugin Path Traversal

The vulnerability of the Jenkins Deployer Framework Plugin is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to download arbitrary files remotely...

CLSA-2022-1660064249 Fix CVE(s): CVE-2022-21434, CVE-2022-21426, CVE-2022-21443, CVE-2022-34169, CVE-2022-21540, CVE-2022-21541, CVE-2022-21476, CVE-2022-21496

Backport upstream releases 8u342 and 8u332 to 16.04 LTS Security fixes in 8u342: - JDK-8272243: Improve DER parsing - JDK-8272249: Better properties of loaded Properties - JDK-8277608: Address IP Addressing - JDK-8281859, CVE-2022-21540: Improve class compilation - JDK-8281866, CVE-2022-21541:...

CVE-2022-36946

A memory corruption flaw was found in the Linux kernel’s Netfilter subsystem in the way a local user uses the libnetfilterqueue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilterqueue is used by a...

ghostscript:gstoraster_fuzzer: Heap-buffer-overflow in pdfi_load_font

Detailed Report: https://oss-fuzz.com/testcase?key=4783989214281728 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6310000c4b18 Crash State: pdfiloadfont...

libreoffice:ww6fuzzer: Heap-buffer-overflow in SwModify::Add

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=4796119074340864 Project: libreoffice Fuzzing Engine: libFuzzer Fuzz Target: ww6fuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash...

UBUNTU-CVE-2022-34927

MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied a crafted XM module file...

Apache MXNet Resource Consumption

The vulnerability of the Apache MXNet software environment for training and deploying deep neural networks is related to an uncontrolled resource consumption during the loading of models with operator names. Exploiting this vulnerability could allow a malicious actor to cause service failures...

ghostscript:gs_device_tiffsep1_fuzzer: Heap-use-after-free in pdfi_load_font_buffer

Detailed Report: https://oss-fuzz.com/testcase?key=5103905893122048 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicetiffsep1fuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x6310000f0850 Crash State:...

Authentication Bypass

firefox is vulnerable to authentication bypass. The vulnerability exists because preload cache bypasses subresource integrity when loading a script which allows an attacker to gain access to internal system and perform unwanted action...

SUSE-SU-2022:2592-1 Security update for rubygem-tzinfo

This update for rubygem-tzinfo fixes the following issues: - CVE-2022-31163: Fixed relative path traversal vulnerability that allows TZInfo::Timezone.get to load arbitrary files bsc1201835...

Linux kernel VT_DISALLOCATE DoS

The vulnerability in the implementation of the VTDISALLOCATE function in Linux operating systems is related to the use of memory after it is freed during the loading of the tty utility. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Apache Calcite security vulnerabilities

Apache Calcite is an open source framework from the US Apache Apache Foundation for building databases and data management systems. A code injection vulnerability exists in the Apache Calcite Avatica JDBC driver, which stems from the fact that classes are not verified to implement the expected...

Malicious code in epic-ue-loading (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d044e670b4e25808611fceec6e531cf961c66589e41ffb8c8c4894a5b6c868b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2771 Malicious code in epic-ue-loading (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d044e670b4e25808611fceec6e531cf961c66589e41ffb8c8c4894a5b6c868b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

clamav:clamav_dbload_CRB_fuzzer: Crash in fp_cmp_mag

Detailed Report: https://oss-fuzz.com/testcase?key=5086737971412992 Project: clamav Fuzzing Engine: libFuzzer Fuzz Target: clamavdbloadCRBfuzzer Job Type: libfuzzerasanclamav Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x61d000011e48 Crash State: fpcmpmag crtmgrtrustlistlookup...

Four Main Reasons Shoppers Abandon eCommerce Carts

More than just window shopping eCommerce shopping cart abandonment causes brands a sobering USD 18 Billion in annual revenue Forrester Research. While rates differ by device, with mobile and tablet device users most likely to leave before completing their order, nearly 70 percent of shoppers dese...

Apache MXNet security vulnerabilities

Apache MXNet is an open source deep learning software framework from the Apache Apache Foundation in the United States. It is used for training and deploying deep neural networks. A security vulnerability exists in Apache MXNet incubating versions prior to 1.9.1, which stems from the use of regul...

PT-2022-3914

Name of the Vulnerable Software and Affected Versions Apache MXNet versions prior to 1.9.1 Description A regular expression used in Apache MXNet is vulnerable to a potential denial-of-service by excessive resource consumption. The issue could be exploited when loading a model in Apache MXNet that...

UBUNTU-CVE-2022-31163

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...

CVE-2022-31163

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...