GSD-2022-1003168 lockdown: also lock down previous kgdb use

lockdown: also lock down previous kgdb use This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.10 by commit...

Samsung Members 安全漏洞

Samsung Members is a community platform app from Samsung, a South Korean company. a code issue vulnerability exists in versions prior to Samsung Members 4.2.005. The vulnerability stems from the fact that dynamic receivers in Samsung Members are not properly protected and can be exploited by...

Lodestar 输入验证错误漏洞

Lodestar is a TypeScript implementation of Ethernet consensus. Versions of Lodestar prior to 0.36.0 suffer from an input validation error vulnerability that stems from the inclusion of maliciously crafted AttesterSlashing or ProposerSlashing on the chain, which may have a consensus split...

Google TensorFlow资源管理错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A resource management error vulnerability exists in Google TensorFlow versions prior to 2.9.0, prior to 2.8.1, prior to 2.7.2, and prior to 2.6.4, which stems from the fact that tf.ragged.consta...

TRENDnet TI-PG1284i Integer Underflow Vulnerability

The TRENDnet TI-PG Series is a series of switches from TRENDnet. A security vulnerability exists in TRENDnet TI-PG1284i versions prior to 2.0.2.S0, no details of the vulnerability are provided at this time...

workflow-cps: Password parameters are included from the original build in replayed builds

A flaw was found in Jenkins. The Pipeline: Groovy Plugin includes password parameters from the original build in replayed builds. This flaw allows attackers with run/replay permission to obtain the values of password parameters passed to previous builds of a Pipeline...

PT-2022-20047 · Agoo · Agoo

Name of the Vulnerable Software and Affected Versions: Agoo versions prior to 2.14.3 Description: The issue arises when Agoo does not reject GraphQL fragment spreads that form cycles, which can lead to an application crash. It has been disputed by the vendor, who claims it is not the server's...

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756 which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756 refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.

...

CVE-2022-1234

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device...

PT-2022-13752 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: libde265 versions prior to 1.0.11 Description: A Heap-based Buffer Overflow issue has been identified in the libde265 library. The issue is related to a buffer overflow, which can be exploited. The fix for this issue is established in a...

PT-2022-6761 · Jszip +1 · Jszip +1

Name of the Vulnerable Software and Affected Versions: JSZip versions prior to 3.8.0 Description: The issue is related to the loadAsync function in JSZip, which allows directory traversal via a crafted ZIP archive. This can be exploited by a remote attacker to write arbitrary files and execute...

CVE-2022-22656

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen...

CVE-2022-22656

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen...

PT-2022-15604 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.6.5 macOS Monterey versions prior to 12.3 macOS Catalina versions prior to Security Update 2022-003 Description: An authentication issue was addressed with improved state management, allowing a local attacker to...

PT-2022-16856 · Stripe · Stripe Cli

Name of the Vulnerable Software and Affected Versions: Stripe CLI versions prior to 1.7.13 Description: A vulnerability exists in Stripe CLI on Windows when certain commands are run in a directory where an attacker has planted files. The affected commands are stripe login, stripe config -e, strip...

OPENSUSE-SU-2022:0705-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.34.6 bsc1196133: - CVE-2022-22620: Processing maliciously crafted web content may have lead to arbitrary code execution. Update to version 2.34.5 bsc1195735: - CVE-2022-22589: A validation issue was addressed with improve...

CVE-2022-25365

Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774...

PT-2022-17120 · Jenkins · Jenkins Pipeline: Groovy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Groovy Plugin versions 2648.va9433432b33c and earlier Description: The issue allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline, as password...

CVE-2022-23437

There's a vulnerability within the Apache Xerces Java XercesJ XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present withi...

GHSA-566M-QJ78-RWW5 Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern regex /\s sourceMappingURL=. PoC js var...