GSD-2022-1007892 iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()

iio: adc: at91adc: fix possible memory leak in at91adcallocatetrigger This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.80 by commit...

AlmaLinux 8 : thunderbird (ALSA-2022:8547)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:8547 advisory. - Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with...

GSD-2022-1007002 ext2: Use kvmalloc() for group descriptor array

ext2: Use kvmalloc for group descriptor array This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

No rate limit via proxy url parameter

Description Hi Drawio Team , Your proxy server has no limit of requests which an attacker can use it as PORT SCANNER. https://app.diagrams.net/proxy?url=IP:PORT&base64=1 Proof of Concept Image from my OWASP ZAP : https://ibb.co/h87hz3N...

Directory traversal

Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack...

GSD-2022-1003192 netfilter: nf_tables: disallow non-stateful expression in sets earlier

netfilter: nftables: disallow non-stateful expression in sets earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.13 by commit...

GSD-2022-1001095 nbd: fix possible overflow on 'first_minor' in nbd_dev_add()

nbd: fix possible overflow on 'firstminor' in nbddevadd This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

GSD-2022-1000357 copy_process(): Move fd_install() out of sighand->siglock critical section

copyprocess: Move fdinstall out of sighand-siglock critical section This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.181 by commit...

GSD-2022-1000208 net/mlx5: Use del_timer_sync in fw reset flow of halting poll

net/mlx5: Use deltimersync in fw reset flow of halting poll This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.97 by commit...

Five Takeaways from FlexBooker’s Data Breach

A few weeks ago, an appointment scheduling solution, FlexBooker notified its customers that it had been breached. Imperva has no specific insider knowledge into how the breach unfolded, but we can learn a lot from FlexBooker’s data breach notification as well as additional related sources. In thi...

GSD-2021-1002285 net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()

net/mlx5e: nullify cq-dbg pointer in mlx5debugcqremove This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.82 by commit...

GSD-2021-1001561 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap

mac80211: limit injected vht mcs/nss in ieee80211parsetxradiotap This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.209 by commit...

UVI-2021-1001204 ALSA: usx2y: Don't call free_pages_exact() with NULL address

ALSA: usx2y: Don't call freepagesexact with NULL address This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.4 by commit...

IBM Jazz Foundation has unspecified vulnerabilities

IBM Jazz Foundation, a next-generation collaboration platform for software delivery technologies from IBM, has a security vulnerability that could be exploited by an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating...

GSD-2021-1000551 net: dsa: mt7530: fix VLAN traffic leaks

net: dsa: mt7530: fix VLAN traffic leaks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.9 by commit...

CVE-2020-26961

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding...

CVE-2020-12926

The Trusted Platform Modules TPM reference software may not properly track the number of times a failed shutdown happens. This can leave the TPM in a state where confidential key material in the TPM may be able to be compromised. AMD believes that the attack requires physical access of the device...

Fetching Full-Text Alert Data with the Wallarm API

A lot of information about detected malicious requests is already available in the Wallarm console UI. However, the search functionality of the Wallarm UI does not provide full visibility into every type of potential attack or full details of a particular alert. If this level of visibility is...

Fetching Full-Text Alert Data with the Wallarm API

A lot of information about detected malicious requests is already available in the Wallarm console UI. However, the search functionality of the Wallarm UI does not provide full visibility into every type of potential attack or full details of a particular alert. If this level of visibility is...

Design/Logic Flaw

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder...