cimage 跨站脚本漏洞

cimage is an application by Mikael Roos personal developer. It is used for server-side image resizing and dynamic cropping, and uses PHP to cache generated image files. A cross-site scripting vulnerability exists in cimage, which stems from a parameter in checksystem.php that causes cross-site...

kernel: watch queue race condition can lead to privilege escalation

A race condition was found in the Linux kernel's watch queue due to a missing lock in the piperesizering. The race condition occurs when a thread uses ioctlIOCWATCHQUEUESETSIZE to resize the pipe buffer and free the old pipe buffer, while another thread uses keyctl to trigger a notification in th...

GSD-2023-1001260 ext4: fix corruption when online resizing a 1K bigalloc fs

ext4: fix corruption when online resizing a 1K bigalloc fs This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

Code injection

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

CVE-2022-22741

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

CVE-2022-34479

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. This bug only affects Thunderbird for Linux. Other operating systems are unaffected.. This vulnerability affects...

Image Optimizer, Resizer and CDN < 6.8.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Step 1: Install the plugin and register for an...

GSD-2022-1006211 ext4: avoid resizing to a partial cluster size

ext4: avoid resizing to a partial cluster size This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1006099 ext4: avoid resizing to a partial cluster size

ext4: avoid resizing to a partial cluster size This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1005769 ext4: avoid resizing to a partial cluster size

ext4: avoid resizing to a partial cluster size This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.138 by commit...

GSD-2022-1005473 ext4: avoid resizing to a partial cluster size

ext4: avoid resizing to a partial cluster size This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

PT-2022-34215 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: The issue concerns the ext4 file system, specifically avoiding resizing to a partial cluster size. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

PT-2022-34027 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.138 Description: The issue concerns the ext4 file system, specifically avoiding resizing to a partial cluster size. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

OPENSUSE-SU-2022:10122-1 Security update for virtualbox

This update for virtualbox fixes the following issues: - Remove package virtualbox-guest-x11, which is no longer needed. - Fix screen resizing under Wayland boo1194126 and boo1194126 Version bump to 6.1.36 released by Oracle July 19 2022 This is a maintenance release. The following items were fix...

SUSE-SU-2022:2289-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 91.11.0 ESR MFSA 2022-25 bsc1200793: - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution bmo1771381 - CVE-2022-31744: CSP bypass enabling stylesheet injection...

Mozilla: A popup window could be resized in a way to overlay the address bar with web content

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a malicious website that creates a popup that could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks...

ROS-20220701-03

Vulnerability in Mozilla Thunderbird email client is related to improper handling of sandbox header CSP without the "allow scripts" parameter. Exploitation of the vulnerability could allow an attacker acting remotely to use an iframe to bypass an implemented restriction. remotely, use an iframe t...

CVE-2022-34479

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a malicious website that creates a popup that could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks...

Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

GHSA-F4W6-3RH6-6Q4Q Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...