CVE-2022-42968

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled...

EulerOS Virtualization 3.0.6.6 : ghostscript (EulerOS-SA-2022-2499)

According to the versions of the ghostscript packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for...

USN-5656-1: JACK vulnerability

Joseph Yasi discovered that JACK incorrectly handled the closing of a socket in certain conditions. An attacker could potentially use this issue to cause a crash...

CVE-2022-31367

Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses...

EulerOS 2.0 SP8 : ghostscript (EulerOS-SA-2022-2220)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839...

Oracle Linux 8 : ruby:2.5 (ELSA-2022-5779)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5779 advisory. - Fix by adding length limit option for methods that parses date strings. Resolves: CVE-2021-41817 Tenable has extracted the preceding description bloc...

Ubuntu 16.04 ESM : Ghostscript vulnerability (USN-5396-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5396-2 advisory. USN-5396-1 addressed a vulnerability in Ghostscript. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the preceding...

SUSE SLES15 Security Update : kernel (Live Patch 28 for SLE 15 SP1) (SUSE-SU-2022:1945-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1945-1 advisory. - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers concurrent calls of PCM hwparams...

Denial of service in bottle

Bottle before 0.12.20 mishandles errors during early request binding...

GHSA-X38J-4RR5-HQRJ git-big-picture Code Execution

git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution...

GHSA-G6W5-439M-JHWV Flarum mishandles invalidation of user email tokens

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens...

GHSA-Q9H8-GPW5-C95C Matrix Sydent mishandles emails

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowedlocal3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on...

Ansible unsafe evaluation of some strings

Ansible prior to 1.5.4 mishandles the evaluation of some strings...

CVE-2022-30763

Janet before 1.22.0 mishandles arrays...

ThinkPHP SQLi Vulnerability

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable...

GHSA-5P4H-3377-7W67 golang.org/x/net/html NULL Pointer Dereference vulnerability

The html package aka x/net/html before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of , , or . This is related to HTMLTreeBuilder.cpp in WebKit...

CVE-2022-30592

liblsquic/lsquicqenchdl.c in LiteSpeed QUIC aka LSQUIC before 3.1.0 mishandles MAXTABLECAPACITY...

CVE-2022-30592

liblsquic/lsquicqenchdl.c in LiteSpeed QUIC aka LSQUIC before 3.1.0 mishandles MAXTABLECAPACITY...

Ubuntu 16.04 ESM : BusyBox vulnerability (USN-5179-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5179-2 advisory. USN-5179-1 fixed vulnerabilities in BusyBox. This update provides the corresponding updates for Ubuntu 16.04 ESM. Tenable has extracted the preceding description...

CVE-2022-30524

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by for example sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denia...