PT-2022-31935

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are separated. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-31731

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.122 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are not properly separated. This is an automated identification of a potential security issue, but the actual impact...

PT-2022-30805

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.4 Description The issue concerns the kernfs component, specifically the separation of kernfs pr cont buf and rename lock. The actual impact and attack plausibility have not yet been proven. Recommendations...

PT-2022-31468

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.47 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are separated. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-32197

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.283 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are not properly separated. This is an automated identification of a potential security issue, but the actual impact...

PT-2022-32084

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.247 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are separated. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-31153

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.15 Description The issue concerns the kernfs component, specifically the separation of kernfs pr cont buf and rename lock. The actual impact and attack plausibility have not yet been proven. Recommendations...

Malicious code in check-pr-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0961e1ec14afe7f9d5370e706429bdc66c4b03ca6d4cc94b81c4a5c7deaaa031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ping-on-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3207a9a6ac9717095c2d6763f67b2f2c915a109c1c32ebb48e28a68753aa11d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5335 Malicious code in ping-on-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3207a9a6ac9717095c2d6763f67b2f2c915a109c1c32ebb48e28a68753aa11d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spark-pr-board (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6229 Malicious code in spark-pr-board (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-831 Malicious code in action-create-release-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f9c096fa3bf9d38477488398a8d49d517f96c85896b4312ef8e8771336c43a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in assign-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e185441fd99093a564a1a297859285aaf49df491f7beb894114173c842fd0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1144 Malicious code in assign-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e185441fd99093a564a1a297859285aaf49df491f7beb894114173c842fd0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

CVE-2022-29220

CVE-2022-29220 concerns the github-action-merge-dependabot GitHub Action. Prior to version 3.2.0, it does not verify that commits created by dependabot are signed with the correct GPG key; it only checks that the PR actor is dependabot[bot]. This enables a threat actor with access to the pipeline...

CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

CVE-2022-29220: Unverified Ownership

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...