Mageia: Security Advisory (MGASA-2019-0229)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AZL-7739 CVE-2022-21363 affecting package mysql for versions less than 8.0.28-1

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful...

Oracle Linux 7 : firefox (ELSA-2022-0124)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-0124 advisory. 91.5.0-1.0.2 - Enabled aarch64 builds 91.5.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 3014329...

CVE-2022-22738

The Mozilla Foundation Security Advisory describes this flaw as: Applying a CSS filter effect could have accessed out-of-bounds memory. This could have led to a heap-buffer-overflow, causing a potentially exploitable crash...

Updated nss and firefox packages fix security vulnerabilities

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox CVE-2021-4140. Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable cra...

GSD-2022-1000047 parisc: Clear stale IIR value on instruction access rights trap

parisc: Clear stale IIR value on instruction access rights trap This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.90 by commit...

GSD-2022-1000045 net/mlx5e: Wrap the tx reporter dump callback to extract the sq

net/mlx5e: Wrap the tx reporter dump callback to extract the sq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.90 by commit...

GSD-2022-1000037 Input: appletouch - initialize work before device registration

Input: appletouch - initialize work before device registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.90 by commit...

GSD-2022-1000033 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

usb: gadget: ffs: Clear ffseventfd in ffsdataclear. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.170 by commit...

GSD-2022-1000026 i2c: validate user data in compat ioctl

i2c: validate user data in compat ioctl This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.224 by commit...

GSD-2022-1000025 Input: appletouch - initialize work before device registration

Input: appletouch - initialize work before device registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.224 by commit...

GSD-2022-1000023 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

usb: gadget: ffs: Clear ffseventfd in ffsdataclear. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.224 by commit...

GSD-2022-1000019 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.

usb: gadget: ffs: Clear ffseventfd in ffsdataclear. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.261 by commit...

GSD-2022-1000012 Input: appletouch - initialize work before device registration

Input: appletouch - initialize work before device registration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.296 by commit...

PT-2022-28350

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.13 Description The issue concerns the use of the get user pages unlocked call in nitro enclaves, which may lead to a potential security problem. The actual impact and attack plausibility have not yet been...

PT-2022-28302

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.4.298 Description A potential security issue exists in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.4.298, update ...

PT-2022-28314

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.224 Description A potential security issue has been identified in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

SQL Injection in pimcore/pimcore

Description The storeId parameter does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection. Proof of Concept 1. Add items to Classification Store: Key definition, Group,... 2. Injection boolean base:...

Hardcoded credentials

A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...

Debian DLA-2874-1 : thunderbird - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2874 advisory. - During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash...