GSD-2022-1000129 phylib: fix potential use-after-free

phylib: fix potential use-after-free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.228 by commit 67d271760b037ce0806d687ee6057edc8afd420...

GSD-2022-1000128 drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable

drm/msm/dsi: invalid parameter check in msmdsiphyenable This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.228 by commit...

GSD-2022-1000101 scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()

scsi: bnx2fc: Flush destroywork queue before calling bnx2fcinterfaceput This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.265 by commit...

GSD-2022-1000089 ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()

ASoC: ops: Reject out of bounds values in sndsocputvolswsx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.300 by commit...

GSD-2022-1000080 usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS

usb: gadget: fsourcesink: Fix isoc transfer for USBSPEEDSUPERPLUS This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.300 by commit...

CVE-2021-46602

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2021-46570

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

Security advisory: QProcess

Recently, the Qt Project's security team was made aware of an issue regarding QProcess and determined it to be a security issue on Unix-based platforms only. We do not believe this to be a considerable risk for applications as the likelihood of it being triggered is minimal. Specifically, the...

CVE-2021-39301

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution...

CVE-2020-6920

Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software...

Pjsua Api 缓冲区错误漏洞

Pjsua Api is an advanced Api for building Sip multimedia user agent applications, and a buffer overflow vulnerability exists in the PJSUA API, which can be exploited to cause a buffer overflow via a controlled "filename" parameter...

flynn/noise has improper nonce handling yielding potential state DoS

The Go package github.com/flynn/noise, a Noise Protocol implementation, has two bugs in nonce handling in versions prior to v1.0.0. Issue 1: Potential nonce overflow If 264 18.4 quintillion or more messages are encrypted with Encrypt after handshaking, the nonce counter will wrap around, causing...

Jenkins Support Core 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Support Core Plugin 2.79 and earlier versions are vulnerable to an information disclosure vulnerability that stems...

CVE-2021-45421

Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can use this misconfiguration to access all the files in the remote directories. Note: the product has not been supported since 2018 and should be removed or replaced...

Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url

Description First Assume this example var parseUrl = require"parse-url" parseUrl"http://[email protected]:[email protected]/path/name?foo=bar&bar=42some-hash" that return : protocols: "http" protocol: "http" port: null resource: "[email protected]" user: "" pathname:...

Five Takeaways from FlexBooker’s Data Breach

A few weeks ago, an appointment scheduling solution, FlexBooker notified its customers that it had been breached. Imperva has no specific insider knowledge into how the breach unfolded, but we can learn a lot from FlexBooker’s data breach notification as well as additional related sources. In thi...

HP Workstation BIOS February 2022 Security Update

A potential security vulnerability has been identified in certain HP Workstation BIOS UEFI firmware which may allow arbitrary code execution. HP is releasing firmware mitigations for the potential vulnerability. HP has identified affected platforms and corresponding SoftPaqs with minimum versions...

Intel® Wireless Bluetooth® and Killer™ Bluetooth® February 2022 Security Updates

Intel has informed HP of potential security vulnerabilities identified in some Intel® Wireless Bluetooth® and Killer™ Bluetooth® products which may allow denial of service. Intel is releasing software and firmware updates to mitigate these potential vulnerabilities. Intel has released updates to...

Intel Wireless Wi-Fi February 2022 Security Update

Intel has informed HP of potential security vulnerabilities identified in some Intel® PROSet/Wireless Wi-Fi, Intel® Active Management Technology Intel® AMT Wireless and Killer™ Wi-Fi products which may allow escalation of privilege, denial of service, or information disclosure. Intel is releasing...

Schneider Electric Modicon Controllers Improper Access Control (CVE-2018-7847)

A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus. This plugin only wor...