PUB-A-242203672

In ffamrdprot of sharedmem.c, there is a possible ID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

The vulnerability of AMD Secure Processor’s microprogramming software is related to synchronization errors when using shared resources (“Race Conditions”). This allows a malicious actor to trigger a service failure.

The vulnerability of AMD Secure Processor ASP microprogramming software is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an attacker to cause a service failure...

[SECURITY] Fedora 37 Update: plasma-thunderbolt-5.27.1-1.fc37

Plasma Sytem Settings module and a KDED module to handle authorization of Thunderbolt devices connected to the computer. There's also a shared library libkbolt that implements common interface between the modules and the system-wide bolt daemon, which does the actual hard work of talking to the...

GHSA-P2HP-3WV3-4W74 ecdh vulnerable to Exposure of Resource to Wrong Sphere

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

ecdh vulnerable to Exposure of Resource to Wrong Sphere

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

Code injection

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

ecdh.js 安全漏洞

ecdh.js is a native Node.js module for ECDH and ECDSA open sourced by Development IL. A security vulnerability exists in versions of ecdh.js prior to 0.2.0, which can be exploited by an attacker to send an invalid point not on the curve as a public key and get a derived shared key...

CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

K17242: Linux kernel SCTP vulnerability CVE-2015-1421

Security Advisory Description Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT...

K69511801: Samba vulnerability CVE-2019-10197

Security Advisory Description A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and...

K15229: BIG-IQ / BIG-IP privilege escalation vulnerability CVE-2014-3220

Security Advisory Description F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/. CVE-2014-3220 Impact An authenticated user with limited...

K51975973: Eclipse Jetty vulnerability CVE-2021-34428

Security Advisory Description For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can...

K13551136: Samba remote code execution vulnerability CVE-2017-7494

Security Advisory Description All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. CVE-2017-7494 Impact There is no impact; F5...

K32562936: Intel CPU vulnerabilities CVE-2020-24511 and CVE-2020-24512

Security Advisory Description CVE-2020-24511 Improper isolation of shared resources in some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2020-24512 Observable timing discrepancy in some IntelR Processors may allow an...

K18484125: Eclipse Jetty vulnerability CVE-2020-27216

Security Advisory Description In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of...

K17839423: PHP vulnerability CVE-2021-21703

Security Advisory Description In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to...

K70517410: The BIG-IP ASM CSRF token may fail to renew when the original web server renews its session

Security Advisory Description This issue occurs when all of the following conditions are met: The BIG-IP ASM cross-site request forgery CSRF protection feature is enabled in a security policy. The CSRF token CSRT expiration time is disabled by default in the security policy. The original web serv...

Malicious Package

Overview arcgis-charts-shared-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...