3824 matches found
CVE-2022-36035: Improper Limitation of a Pathname to a Restricted Directory
Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...
GHSA-V78C-4P63-2J6C Cleartext Transmission of Sensitive Information in moment-timezone
Impact if Alice uses grunt data or grunt release to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata...
CVE-2022-25887: Inefficient Regular Expression Complexity
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...
CVE-2022-34302
A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...
SUSE-SU-2022:2912-1 Security update for postgresql13
This update for postgresql13 fixes the following issues: - Update to 13.8: - CVE-2022-2625: Fixed an issue where extension scripts would replace objects not belonging to that extension bsc1202368...
Design/Logic Flaw
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...
CVE-2022-23460 Stack overflow in Jsonxx
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...
CVE-2022-23460 Stack overflow in Jsonxx
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized ASAN build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the...
MAL-2022-41 Malicious code in 6jestlr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8502727faa86fcf1f0e21fabb5be58cb389a0bc6f108397bb8942a91584121f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PostgreSQL Privilege Escalation
The vulnerability of the PostgreSQL database management system is related to errors that occur when using OR commands with extensions. Exploiting this vulnerability allows a malicious actor to increase their privileges and replace arbitrary objects in the database...
Jenkins Openstack Heat Plugin Auth Bypass
The vulnerability of the Jenkins Openstack Heat Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to remotely replace the URL address...
Description of the security update for Excel 2016: August 9, 2022 (KB5002232)
None None...
Description of the security update for Office Online Server: August 9, 2022 (KB5002228)
None None...
PT-2022-4321
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an error in resource management in the Linux kernel's route4 change function, which can be exploited to cause a denial of service or execute arbitrary code. The...
Smap - A Drop-In Replacement For Nmap Powered By Shodan.Io
Smap is a replica of Nmap which uses shodan.io's free API for port scanning. It takes same command line arguments as Nmap and produces the same output which makes it a drop-in replacament for Nmap. Features Scans 200 hosts per second Doesn't require any account/api key Vulnerability detection...
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks
Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...
GHSA-RQMG-HRG4-FM69 Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks
Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...
CVE-2022-37450
Go Ethereum (geth)
CVE-2022-37450: Undefined Security Weakness
Go Ethereum aka geth through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making RUM, as exploited in the wild in 2020 through 2022...
Go Ethereum 安全漏洞
Go Ethereum is an official Go implementation of the Ether protocol for the Ethereum community. A security vulnerability exists in Go Ethereum version 1.10.21, which stems from allowing an attacker to increase rewards by mining blocks under certain circumstances and using time-differential value...