Puppet 日志信息泄露漏洞

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the United States, which can be used to manage profiles, users, cron tasks, packages, system services, and more. A log information disclosure vulnerability exists in Puppet Bolt versions...

Oracle JD Edwards Products 输入验证错误漏洞

Oracle JD Edwards Products is a fully integrated suite of Enterprise Resource Planning ERP applications from Oracle. The products provide application modules for financial management, project management, and asset lifecycle management. An input validation error vulnerability exists in Oracle JD...

[SECURITY] Fedora 35 Update: source-to-image-1.3.1-4.fc35

Source-to-Image S2I is a toolkit and workflow for building reproducible container images from source code. S2I produces ready-to-run images by injecting source code into a container image and letting the container prepare that source code for execution. By creating self-assembling builder images,...

[SECURITY] Fedora 35 Update: golang-google-appengine-1.6.7-5.fc35

This package supports the Go runtime on App Engine standard. It provides APIs for interacting with App Engine services...

[SECURITY] Fedora 35 Update: golang-github-pquerna-ffjson-0-0.9.20200730gitaa0246c.fc35

Ffjson generates static MarshalJSON and UnmarshalJSON functions for structures in Go. The generated functions reduce the reliance upon runtime reflection to do serialization and are generally 2 to 3 times faster. In cases where ffjson doesn't understand a Type involved, it falls back to...

[SECURITY] Fedora 35 Update: golang-github-google-wire-0.4.0-6.fc35

Wire is a code generation tool that automates connecting components using dependency injection. Dependencies between components are represented in Wire as function parameters, encouraging explicit initialization instead of global variables. Because Wire operates without runtime state or reflectio...

[SECURITY] Fedora 35 Update: containerd-1.6.6-4.fc35

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

AZL-41051 CVE-2022-32213 affecting package rust for versions less than 1.75.0-1

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling HRS...

PT-2022-12371 · Sage · Sage 300 Erp

Name of the Vulnerable Software and Affected Versions: Sage 300 ERP versions through 6.8.x Description: The installer configures the C:SageSage300Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because...

WebSphere Application Server and IBM HTTP Server Security Bulletin List

Question Is there a list that contains the security bulletins that apply to WebSphere Application Server and IBM HTTP Server? Answer The following table is provided to help you locate WebSphere Application Server and IBM HTTP Server security bulletins. These are listed numerically by CVE number n...

Nodejs Dll hijacking vulnerability

Node.js is an open source and cross-platform JavaScript runtime environment. nodejs suffers from a Dll hijacking vulnerability, which can be exploited by attackers to inject malicious dlls into nodejs and execute code within Nodejs...

The vulnerability of the Client Server Run-Time Subsystem (CSRSS) in the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Client Server Run-Time Subsystem CSRSS in the Windows operating system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2022-22026

Windows Client Server Run-time Subsystem CSRSS Elevation of Privilege Vulnerability...

CVE-2022-22038

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

CVE-2022-22038

Remote Procedure Call Runtime Remote Code Execution Vulnerability...

CVE-2022-22038 Remote Procedure Call Runtime Remote Code Execution Vulnerability

...

CVE-2022-22038

CVE-2022-22038 is a Remote Procedure Call Runtime Remote Code Execution vulnerability. Connected sources note a POC exploit exists and that exploitation would require multiple attempts with high attack complexity, potentially over a network. The available documents do not specify affected product...

CVE-2022-22038 Remote Procedure Call Runtime Remote Code Execution Vulnerability

...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-31146 via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-31146 Source advisory: OSV:RUSTSEC-2022-0100...

CVE-2022-34466

A vulnerability has been identified in Mendix Applications using Mendix 9 All versions = V9.11 V9.15, Mendix Applications using Mendix 9 V9.12 All versions V9.12.3. An expression injection vulnerability was discovered in the Workflow subsystem of Mendix Runtime, that can affect the running...