CVE-2022-3094

Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions ACLs and is...

Slackware Linux 15.0 / current bind Multiple Vulnerabilities (SSA:2023-025-01)

The version of bind installed on the remote host is prior to 9.16.37 / 9.18.11. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-025-01 advisory. - BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client- timeout is...

Security Bulletin: FileNet Content Manager GraphQL jackson-databind security vulnerabilities, affected but not vulnerable

Summary FileNet Content Manager GraphQL jackson-databind security vulnerabilities CVE-2022-42003 and CVE-2022-42004, affected but not vulnerable Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in...

Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive

The Mozilla Foundation Security Advisory describes this flaw as: Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser...

cmark-gfm 资源管理错误漏洞

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version with canonical Markdown syntax. A resource management error vulnerability exists in versions prior to cmark-gfm 0.29.0.gfm.7. An attacker could exploit this vulnerability to cause unlimited...

The vulnerability of Zoom’s video conferencing software relates to synchronization errors when using shared resources, allowing attackers to execute arbitrary code with system privileges.

The vulnerability of Zoom’s video conferencing software is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to execute arbitrary code with system privileges...

The vulnerability of the Windows GDI component in Microsoft Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Windows GDI component in Microsoft Windows systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

The vulnerability of Containerd’s execution environment, related to the improper assignment of permissions to critical resources, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Containerd execution environment is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

CVE-2023-21834

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workflow, Approval, Work Force Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP t...

CVE-2023-21834

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workflow, Approval, Work Force Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP t...

Design/Logic Flaw

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workflow, Approval, Work Force Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP t...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business...

Apache Superset Cross-Site Request Forgery Vulnerability

A cross-site request forgery vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation. The vulnerability stems from the failure of two legacy REST APIs for granting and requesting access to properly validate user input, which could be...

PT-2025-52948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s drm/msm/dpu subsystem where unallocated resources can be returned. Specifically, if a topology requests resources not created by the system, the dpu r...

CVE-2023-21834

CVE-2023-21834 affects Oracle E-Business Suite 12.2.3–12.2.12, specifically the Workflow, Approval, and Work Force Management components (Self-Service Human Resources). A low-privilege, network-accessible attacker can exploit via HTTP to }compromise data integrity, enabling unauthorized update, i...

kubernetes: Unauthorized read of Custom Resources

A flaw was found in kubernetes. Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different kind in the same API group they are not authorized to read...

CVE-2022-23739

An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that a...

CVE-2022-23739

An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that a...

Authorization

An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that a...

GSD-2023-1001240 perf tools: Fix resources leak in perf_data__open_dir()

perf tools: Fix resources leak in perfdataopendir This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...