OESA-2022-2042 multipath-tools security update

This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically,monitors path devices for failure, removal, or addition, and applies the necessary changes to the...

CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

Metabase 输入验证错误漏洞

Metabase is an open source data analytics platform from the US-based Metabase, Inc. A security vulnerability exists in Metabase that stems from a custom GeoJSON map URL address that will follow a redirect to an address that is otherwise not allowed, such as a link to a local or private network...

PT-2022-24927 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns Metabase, a data visualization software. In affected versions, a custom GeoJSON map URL address would follow redirec...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

Cross site scripting

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

Esri Arcgis Server 跨站脚本漏洞

Esri Arcgis Server is a Web-oriented, enterprise-class software platform for delivering geolocation services from Environmental Systems Research Institute Esri. A security vulnerability exists in Esri Arcgis Server versions 10.8.1 and 10.7.1, which stems from a cross-site scripting vulnerability ...

net.praqma:memory-map (>=2.2.0 <=2.2.1), org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.1 <=2.4) +5 more potentially affected by CVE-2022-43408 via org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view (>=1.3 <=2.10)

org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view MAVEN version =1.3, =2.2.0, =2.1, =2.0.5, =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2022-43408 Source advisory: OSV:GHSA-G975-F26H-93G8...

GSD-2022-1006582 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.146 by commit...

GSD-2022-1006555 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.71 by commit...

GSD-2022-1006515 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.12 by commit...

GSD-2022-1006471 net/smc: Stop the CLC flow if no link to map buffers on

net/smc: Stop the CLC flow if no link to map buffers on This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0 by commit...

OESA-2022-1957 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Contex...

WorkOrder CMS 0.1.0 Cross Site Scripting / SQL Injection Vulnerabilities

Exploit Title: WorkOrder CMS 0.1.0 Cross-Site Scripting XSS Date: Sep 22, 2022 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/romzes13/WorkOrderCMS Software Link: https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip Version: 0.1.0 Payload:...

The vulnerability of the verifier functions ebpf in the bpf_map_update_elem and bpf_map_freeze components of the Linux operating system’s kernel/bpf/syscall.c module allows a attacker to compromise data integrity.

The vulnerability of the verifier functions ebpf in the bpfmapupdateelem and bpfmapfreeze components of the Linux operating system’s kernel/bpf/syscall.c file is related to the absence of locking mechanisms. Exploiting this vulnerability allows an attacker to compromise data integrity...

kernel: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap

In the Linux kernel, the following vulnerability has been resolved: ice: arfs: fix use-after-free when freeing @rxcpurmap The CI testing bots triggered the following splat: 718.203054 BUG: KASAN: use-after-free in freeirqcpurmap+0x53/0x80 718.206349 Read of size 4 at addr ffff8881bd127e00 by task...

The vulnerability of the GNU C Library, related to memory initialization errors, allows a perpetrator to gain access to confidential data.

The vulnerability of the GNU C Library is related to the incorrect handling of LDPREFERMAP32BITEXEC. Exploiting this vulnerability allows an attacker to access confidential data...

GSD-2022-1005523 bpf: Don't reinit map value in prealloc_lru_pop

bpf: Don't reinit map value in prealloclrupop This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1005281 bpf: fix potential 32-bit overflow when accessing ARRAY map element

bpf: fix potential 32-bit overflow when accessing ARRAY map element This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...