GHSA-9773-3FQG-8W25 OpenStack Neutron's unsupported dport option prevents applying security groups

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option for example, VRRP, an...

no-revert-on-transfer ERC20 tokens can be drained

Lines of code Vulnerability details Impact Some ERC20 tokens don't throw but just return false when a transfer fails. This can be abused to trick the createVault function to initialize the vault without providing any tokens. A good example of such a token is ZRX: Etherscan code When such a vault ...

TLS and SSH connection too eager reuse

libcurl would reuse a previously created connection even when a TLS or SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several TLS and...

kernel: mptcp: fix deadlock in __mptcp_push_pending()

A vulnerability was found in the Linux kernel's mptcp component in the mptcppushpending function, where a deadlock can occur when calling mptcpflushjoinlist with the subflow socket lock held. This happens if the synchronization function mptcpsockoptsyncall is invoked, causing the system to hang d...

mod_auth_openidc: XSS when using OIDCPreservePost On

A flaw was found in modauthopenidc. When modauthopenidc is configured with OIDCPreservePost On it is possible to trigger a cross site scriptingXSS vulnerability that could be used by a remote attacker to execute code on the browser of the victim user. The highest threat from this flaw is to data...

ESET NOD32 Antivirus 安全漏洞

ESET NOD32 Antivirus is a suite of antivirus programs from ESET Slovakia. A security vulnerability exists in ESET NOD32 Antivirus, which can be exploited by an attacker to escalate privileges via repair and uninstall options...

WordPress Sitemap by click5 plugin存在未明漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Sitemap by click5 plugin version 1.0.36 has a security vulnerability that could be exploite...

SUSE-SU-2022:1427-1 Security update for cifs-utils

This update for cifs-utils fixes the following issues: - CVE-2022-27239: Fixed a buffer overflow in the command line ip option bsc1197216...

ALBA-2022:1564 gdm bug fix and enhancement update

The GNOME Display Manager GDM provides the graphical login screen. The screen is shown shortly after boot, after log out, and when switching the current user. Bug Fixes and Enhancements: "DisallowTCP=false" option is not being used by /etc/gdm/custom.conf file BZ2029202...

GSD-2022-1001657 macvlan: Fix leaking skb in source mode with nodst option

macvlan: Fix leaking skb in source mode with nodst option This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.35 by commit...

GSD-2022-1001601 ext4: make mb_optimize_scan performance mount option work with extents

ext4: make mboptimizescan performance mount option work with extents This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001294 ext4: make mb_optimize_scan performance mount option work with extents

ext4: make mboptimizescan performance mount option work with extents This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1000978 macvlan: Fix leaking skb in source mode with nodst option

macvlan: Fix leaking skb in source mode with nodst option This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.4 by commit...

PT-2022-26103 · Unknown +8 · Freeradius +7

Name of the Vulnerable Software and Affected Versions: freeradius affected versions not specified Description: The issue occurs when an EAP-SIM supplicant sends an unknown SIM option to the server. The server attempts to look up this option in its internal dictionaries, which fails. However, the...

Design/Logic Flaw

next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already...

CVE-2022-1020

The Product Table for WooCommerce wooproducttable WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing...

SWHKD has unspecified vulnerabilities

SWHKD is a hotkey daemon made with Rust that is independent of the display protocol. SWHKD has security vulnerabilities that can be exploited by attackers to perform arbitrary file presence tests with the -c option...

Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

CVE-2022-27814

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option...

CVE-2022-27814

CVE-2022-27814 relates to SWHKD 1.1.5, where the -c option allows arbitrary file-existence tests. The connected sources confirm the vulnerable component is the SWHKD daemon and the condition is a flaw in the -c flag that enables probing for file presence, implying local, low-complexity exploitati...