PT-2023-33095 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.13 Description: The issue is related to a call to tipc lxc xmit without holding node read lock. This problem was introduced in version v5.5 and is fixed in Linux Kernel version v6.0.13. The actual impact an...

PT-2023-33282 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.159 Description: The issue arises from a call to tipc lxc xmit without holding node read lock. This problem was introduced in version v5.5 and is fixed in Linux Kernel version v5.10.159. Recommendations: F...

CVE-2023-22492 RefreshToken invalidation vulnerability

ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The...

GHSA-6RRR-78XP-5JP8 Zitadel RefreshToken invalidation vulnerability

Impact RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtai...

PT-2025-13311

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Linux kernel related to the -anon vma attachment to the VMA. The issue arises when collapse and free pmd requires the -anon vma to be locked, but the lock ...

Improper Locking

openssl is vulnerable to denial of service DoS attacks. When an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems this results in a denial of service when the affected process han...

Why does technology no longer excite us? Lock and Code S04E01

When did technology last excite you? If Douglas Adams, author of The Hitchhiker's Guide to the Galaxy, is to be believed, your own excitement ended, simply had to end, after turning 35 years old. Decades ago, at first writing privately and later having those private writings published after his...

PT-2025-37897

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to a NULL dereference within the blk mq elv switch none function. This issue occurs when the q-elevator pointer becomes NULL after acquiring the...

PT-2025-54170

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the multipath target when the retrieve deps function runs concurrently with multipath message. This occurs because retrieve deps iterates through a list of ope...

PT-2025-37672

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.25-android14-5-maybe-dirty-mainline Description The Linux kernel contained an issue where the detection of atomic context was insufficient, potentially leading to problems when z erofs decompressqueue endio w...

PT-2025-54092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s drm/nouveau/kms/nv50 component related to the initialization of the hpd irq lock for PIOR DP. This issue causes an OOPS error on systems utilizing...

Disconnected sessions not reconnecting in Server VDA 2203 and higher

After a disconnection the user profile stays active on the server the user was first logged and is locked. When users get disconnected and click the Desktop-icon to get into their session again, they always get a temporary profile on another server. No additional configuration regarding...

Fedora 36 : xen (2022-5b594b82ac)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-5b594b82ac advisory. Arm: unbounded memory consumption for 2nd-level page tables XSA-409, CVE-2022-33747 P2M pool freeing may take excessively long XSA-410, CVE-2022-337...

CVE-2022-22743

When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

CVE-2022-4287

Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access the application...

CVE-2022-4287

Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access the application...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2022:4586-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4586-1 advisory. - CVE-2022-3996: Fixed X.509 Policy Constraints Double Locking bsc1206374 Tenable has extracted...

CVE-2022-4287

Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access the application...

PT-2022-26641 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2022.3.26 and earlier Description: The issue allows a malicious user to bypass the local application lock feature, gaining access to the application. This can be exploited by malicious users to acce...

CVE-2022-23488 BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when th...