mprweb 信息泄露漏洞

mprweb is a makedeb package repository MPR hosting platform open-sourced by makedeb. An information disclosure vulnerability exists in previous versions of mprweb d13e3f2f5a9c0b0f6782f35d837090732026ad77, which stems from an email address that is not hidden...

CVE-2022-25896

A misleading session regeneration flaw was found in passport. When a user logs in or logs out, the session is regenerated instead of being closed. This flaw allows an attacker to use a previous session in particular environments. Mitigation Mitigation for this issue is either not available or the...

Regular Expression Denial Of Service (ReDoS)

scss-tokenizer is vulnerable to regular expression denial of service. The vulnerability exists in the loadAnnotation function of previous-map.js due to the insecure regex pattern used in the match attribute, allowing an attacker to crash the application by providing malicious input...

CVE-2022-34789

A cross-site request forgery CSRF vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds...

CVE-2022-34789

A cross-site request forgery CSRF vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds...

GSD-2022-1003168 lockdown: also lock down previous kgdb use

lockdown: also lock down previous kgdb use This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.10 by commit...

Samsung Members 安全漏洞

Samsung Members is a community platform app from Samsung, a South Korean company. a code issue vulnerability exists in versions prior to Samsung Members 4.2.005. The vulnerability stems from the fact that dynamic receivers in Samsung Members are not properly protected and can be exploited by...

Lodestar 输入验证错误漏洞

Lodestar is a TypeScript implementation of Ethernet consensus. Versions of Lodestar prior to 0.36.0 suffer from an input validation error vulnerability that stems from the inclusion of maliciously crafted AttesterSlashing or ProposerSlashing on the chain, which may have a consensus split...

Google TensorFlow资源管理错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A resource management error vulnerability exists in Google TensorFlow versions prior to 2.9.0, prior to 2.8.1, prior to 2.7.2, and prior to 2.6.4, which stems from the fact that tf.ragged.consta...

TRENDnet TI-PG1284i Integer Underflow Vulnerability

The TRENDnet TI-PG Series is a series of switches from TRENDnet. A security vulnerability exists in TRENDnet TI-PG1284i versions prior to 2.0.2.S0, no details of the vulnerability are provided at this time...

workflow-cps: Password parameters are included from the original build in replayed builds

A flaw was found in Jenkins. The Pipeline: Groovy Plugin includes password parameters from the original build in replayed builds. This flaw allows attackers with run/replay permission to obtain the values of password parameters passed to previous builds of a Pipeline...

PT-2022-20047 · Agoo · Agoo

Name of the Vulnerable Software and Affected Versions: Agoo versions prior to 2.14.3 Description: The issue arises when Agoo does not reject GraphQL fragment spreads that form cycles, which can lead to an application crash. It has been disputed by the vendor, who claims it is not the server's...

PT-2022-18630

Name of the Vulnerable Software and Affected Versions Samsung Pass versions prior to 3.7.07.5 Description The issue is related to improper exception handling, allowing a physical attacker to view the previously running screen without authentication. Recommendations For versions prior to 3.7.07.5,...

CVE-2022-27841: Improper Check or Handling of Exceptional Conditions

Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that is previously running without authentication...

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756 which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756 refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.

...

CVE-2022-1234

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device...

PT-2022-13752 · Libde265 +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: libde265 versions prior to 1.0.11 Description: A Heap-based Buffer Overflow issue has been identified in the libde265 library. The issue is related to a buffer overflow, which can be exploited. The fix for this issue is established in a...

PT-2022-6761 · Jszip +1 · Jszip +1

Name of the Vulnerable Software and Affected Versions: JSZip versions prior to 3.8.0 Description: The issue is related to the loadAsync function in JSZip, which allows directory traversal via a crafted ZIP archive. This can be exploited by a remote attacker to write arbitrary files and execute...

CVE-2022-22656

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen...

CVE-2022-22656

An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen...