GSD-2022-1007297 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()

wifi: ath10k: add peer map clean up for peer delete in ath10kstastate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...

GSD-2022-1006866 wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()

wifi: ath10k: add peer map clean up for peer delete in ath10kstastate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-27002 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS formerly concrete5 versions 9.0.0 through 9.1.2 Concrete CMS formerly concrete5 versions prior to 8.5.10 Description: The issue allows the authTypeConcreteCookieMap table to be filled up, causing a denial of service due to high...

PT-2022-35121 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the wifi ath10k driver in the Linux Kernel. It involves the peer map clean up for peer delete in the ath10k sta state function. The actual impact and attack plausibili...

PT-2022-35859

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.296 Description The issue is related to the wifi ath10k driver in the Linux Kernel. It involves the peer map clean up for peer delete in the ath10k sta state function. The actual impact and attack...

PortlandLabs Concrete CMS 资源管理错误漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. in the United States. A security vulnerability exists in Concrete CMS formerly concrete5 versions prior to 8.5.10 and versions 9.0.0 through 9.1.2, which stems from the fact that its...

PT-2022-35919

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.331 Description The issue is related to the wifi ath10k driver in the Linux Kernel. It involves the peer map clean up for peer delete in the ath10k sta state function. The actual impact and attack plausibili...

Unlimited length of LineOfCredit.ids: storage collisions

Lines of code Vulnerability details Impact There are no restrictions for ids length So malicious borrower may create many credits and replace storage slot data at some position Proof of Concept 1. LineOfCredit.ids saves array size in slot Oracle data feed is insufficiently validated in Oracle.sol...

kernel: RDMA/hfi1: Prevent use of lock before it is initialized

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Prevent use of lock before it is initialized If there is a failure during probe of hfi1 before the sdmamaplock is initialized, the call to hfi1freedevdata will attempt to use a lock that has not been initialized. If th...

kernel: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffermutex and mmaplock syzbot caught a potential deadlock between the PCM runtime-buffermutex and the mm-mmaplock. It was brought by the recent fix to cover the racy read/write and other...

skia:api_raster_n32_canvas: Heap-buffer-overflow in compute_displacement

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5176140562300928 Project: skia Fuzzing Engine: afl Fuzz Target: apirastern32canvas Job Type: aflasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x62f00000c400 Cras...

OESA-2022-2042 multipath-tools security update

This package provides the multipath tool and the multipathd daemon to manage dm-multipath devices. multipath can detect and set up multipath maps. multipathd sets up multipath maps automatically,monitors path devices for failure, removal, or addition, and applies the necessary changes to the...

CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior ...

PT-2025-41048

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc1-roce-flush+ 25 Description The Linux kernel contains a flaw in the RDMA/rxe subsystem related to double freeing of memory associated with memory registration mr-map. Specifically, the rxe mr cleanup...

Metabase 输入验证错误漏洞

Metabase is an open source data analytics platform from the US-based Metabase, Inc. A security vulnerability exists in Metabase that stems from a custom GeoJSON map URL address that will follow a redirect to an address that is otherwise not allowed, such as a link to a local or private network...

CVE-2022-39359

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

PT-2022-24927 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 Description: The issue concerns Metabase, a data visualization software. In affected versions, a custom GeoJSON map URL address would follow redirec...

CVE-2022-39359: Exposure of Sensitive Information to an Unauthorized Actor

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address would follow redirects to addresses that were otherwise disallowed, like link-local or private-network. This issue is patched in versions...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...

CVE-2022-38200

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser...