PT-2022-36235

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.5 through 5.15.77 Description The issue concerns a problem with tree mod log mishandling of reallocated nodes in btrfs. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...

GHSA-J7QP-MFXF-8XJW libp2p DoS vulnerability from lack of resource management

Impact Versions older than v0.18.0 of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed ...

SUSE-SU-2022:4332-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let xenstored run out of memory bsc1204482 - CVE-2022-42309: xen: Xenstore: Guests can crash...

DEBIAN-CVE-2022-46338

g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The vulnerability exists because node transactions are not properly handled which allows an attacker to cause an application crash by creating arbitrary number of nodes...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The vulnerability exists due to the large memory allocation in the library, allowing an attacker to create many nodes more than the maximum allowed size and path length by accessing many nodes inside a transaction...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The vulnerability exists during the node transaction which allows an attacker to cause an application crash by creating arbitrary number of nodes...

Xenstore: Cooperating guests can create arbitrary numbers of nodes (XSA-419)

Xenstore: Two malicious guests working together can create an arbitrary number of Xenstore nodes and drive xenstored into an out of memory situation. This is possible by domain A letting domain B write into domain A local Xenstore tree. Domain B can then create many nodes and reboot. The nodes...

Cross-site Scripting (XSS)

flarum is vulnerable to cross-site scripting XSS. The library's page title system enables page titles to be converted into HTML DOM nodes when pages are rendered, which allows an attacker to inject malicious HTML markup using a discussion title input when a visitor opens the relevant discussion...

Xenstore: Guests can create orphaned Xenstore nodes (XSA-415)

By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

Witness Block Parsing DoS Vulnerability

Impact All lnd nodes before version v0.15.4 are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on...

Information Disclosure

github.com/hashicorp/consul is vulnerable to information disclosure. The vulnerability exists in Filter function of filter.go because the data imported from peers is not properly filtered by ACLs at the UI Nodes which allows an attacker to gain access to the ACL tokens and view sensitive...

UBUNTU-CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920 Consul Peering Imported Nodes/Services Leak

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920 Consul Peering Imported Nodes/Services Leak

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

GSD-2022-1007372 ata: libahci_platform: Sanity check the DT child nodes number

ata: libahciplatform: Sanity check the DT child nodes number This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.220 by commit...

PT-2022-35627

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.220 Description A potential security issue exists due to a sanity check on the DT child nodes number in libahci platform. The actual impact and attack plausibility have not yet been proven. Recommendations F...