2231 matches found
CVE-2022-37706
enlightenmentsys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring...
Fedora 35 : lighttpd (2022-c26b19568d)
The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c26b19568d advisory. 1.4.67 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but h...
GSD-2022-1007831 btrfs: fix tree mod log mishandling of reallocated nodes
btrfs: fix tree mod log mishandling of reallocated nodes This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.8 by commit...
Ubuntu 16.04 ESM : HarfBuzz vulnerability (USN-5746-1)
The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5746-1 advisory. Behzad Najjarpour Jabbari discovered that HarfBuzz incorrectly handled certain inputs. A remote attacker could possibly use this issue to cause a denial of servic...
PT-2022-27662 · Iterm2 · Iterm2
Name of the Vulnerable Software and Affected Versions: iTerm2 versions prior to 3.4.18 Description: The issue is related to the mishandling of a DECRQSS response. Recommendations: For versions prior to 3.4.18, update to version 3.4.18 or later to resolve the issue...
CVE-2022-45872
iTerm2 before 3.4.18 mishandles a DECRQSS response...
buildah: possible information disclosure and modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able t...
CVE-2022-42978
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system...
NewStart CGSL MAIN 6.02 : tigervnc Vulnerability (NS-SA-2022-0084)
The remote NewStart CGSL host, running version MAIN 6.02, has tigervnc packages installed that are affected by a vulnerability: - In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities,...
CVE-2022-42978
The vulnerability CVE-2022-42978 affects the Netic User Export add-on for Atlassian Confluence prior to version 1.3.5. The root cause is mishandled authorization, allowing an unauthenticated attacker to access files on the remote system. Impact is unauthorized file access. Remediation: upgrade to...
AlmaLinux 8 : openjpeg2 (ALSA-2022:7645)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:7645 advisory. - A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocat...
Amazon Linux 2 : dbus (ALAS-2022-1870)
The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1870 advisory. A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client...
Buffer overflow
The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call RPC into a single array of pages. A client can force the send...
device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...
device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...
CVE-2022-41974
A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...
USN-5689-1 perl vulnerability
It was discovered that Perl incorrectly handled certain signature verification. An remote attacker could possibly use this issue to bypass signature verification...
PYSEC-2022-43183
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...
PYSEC-2022-43183
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not bein...
