SUSE CVE-2021-21274

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

SUSE CVE-2022-2503

Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear...

JSA10385 - Certain crafted packets can crash Steel-Belted Radius or hijack the server machine.

Last Modified Date Mar 10, 2023 8:08:40 AM...

CVE-2023-25161 Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage...

PT-2023-14755 · WordPress · Twenty20 Image Before-After

Name of the Vulnerable Software and Affected Versions: Twenty20 Image Before-After WordPress plugin versions 1.5.9 and earlier Description: The issue concerns the Twenty20 Image Before-After WordPress plugin, which does not properly validate and escape some of its shortcode attributes before...

PT-2023-34921 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.11 Description: The issue concerns an invalid kfunc call in backtrack insn within the bpf. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

PT-2023-6832 · Python · Python

Name of the Vulnerable Software and Affected Versions: IPython versions prior to 8.10.0 Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. Exploitation of this issue may allow an attacker to execute arbitrary commands by...

PT-2023-18199 · Samsung · Bixby Vision

Name of the Vulnerable Software and Affected Versions: Bixby Vision versions prior to 3.7.70.17 Description: The issue is related to improper input validation, which allows an attacker to access Bixby Vision data. Recommendations: For versions prior to 3.7.70.17, update to version 3.7.70.17 or...

PT-2023-6770 · Open Design Alliance · Open Design Alliance Drawings Sdk

Name of the Vulnerable Software and Affected Versions: Open Design Alliance Drawings SDK versions prior to 2023.6 Description: The issue is related to a heap-based buffer overflow in the DXF file reading procedure. This occurs due to the lack of proper validation of the length of user-supplied...

Information disclosure

In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB001232...

CVE-2022-32642

In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07326547; Issue ID: ALPS07326547...

Out-of-bounds

In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494067; Issue ID: ALPS07494067...

Null pointer dereference

In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20220720014; Issue ID: GN20220720014...

Integer overflow

In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494107; Issue ID: ALPS07494107...

PT-2023-13096 · Ccd · Ccd

Name of the Vulnerable Software and Affected Versions: ccd affected versions not specified Description: The issue is related to a possible memory corruption due to a race condition in ccd. This could lead to local escalation of privilege with System execution privileges needed. User interaction i...

ASB-A-245860753

In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-34759 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.8 Description: The issue is related to the proc-empty-vm and proc-pid-vm tests in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2023-34811 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.90 Description: The issue is related to the dmaengine: idxd, where the probe fails when the workqueue cannot be enabled. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2023-34788 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.7 Description: The issue is related to a regression in event counts in reused RMIDs in the x86/resctrl component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Lin...

MAL-2023-995 Malicious code in yandex-yt-yson-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef8f5064d17e16f308f05ff124d515f803d1acfdc65fa58b4c26a8ac52041b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...