CVE-2022-2111 Unrestricted Upload of File with Dangerous Type in inventree/inventree

Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2...

Reading on uninitialized memory may cause UB ( `util::read_spv()` )

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. Arbitrary Read implementations can read from the uninitialized buffer memory exposure and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory...

CVE-2022-21123

Incomplete cleanup of multi-core shared buffers for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access...

Remote Code Execution (RCE)

grub2 is vulnerable to remote code execution. The vulnerability exists due to an out-of-bounds write in the heap area allowing an attacker to inject maliciously crafted script into the system via a crafted 16-bit grayscale PNG image which allows an attacker to inject malicious codes...

OPENSUSE-SU-2022:10009-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 102.0.5005.115 boo1200423 CVE-2022-2007: Use after free in WebGPU CVE-2022-2008: Out of bounds memory access in WebGL CVE-2022-2010: Out of bounds read in compositing CVE-2022-2011: Use after free in ANGLE Chromium 102.0.5001.61...

CVE-2022-2079 Cross-site Scripting (XSS) - Stored in nocodb/nocodb

Cross-site Scripting XSS - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+...

NocoDB information disclosure vulnerability

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents...

MGASA-2022-0226 Updated php-smarty packages fix security vulnerability

Template authors could inject php code by choosing a malicious block name or include file name. CVE-2022-29221...

RLSA-2022:4990 Important: cups security update

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fixes: cups: authorization bypass when using "local" authorization CVE-2022-26691 For more details about the security issues, including the impact, a CVSS score,...

MAL-2022-828 Malicious code in acronis-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 431e7c9d70568e5dfdc18aeb99d4ffddb22487462dea0588b1b5d29feebf36c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-41641

Deno =1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory...

MAL-2022-416 Malicious code in @manomano-toolbox/hub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce330b8bf18cd09a6c497d52b9254f771600e32cee266dc414d683502e01e67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authorization Bypass Through User-Controlled Key in go-restful

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0...

GHSA-R48Q-9G5R-8Q2H Authorization Bypass Through User-Controlled Key in go-restful

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0...

CVE-2021-40589

ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits...

CVE-2022-1993 Path Traversal in gogs/gogs

Path Traversal in GitHub repository gogs/gogs prior to 0.12.9...

MAL-2022-6415 Malicious code in tangerine-state-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83cabb2630e510d0c9b63f6c164c5825dd5325a370fd8db846ead2bb3ed782a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6333 Malicious code in stripe-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6768625a605caa8f499ca468486f47122cb94054148e3489c677ca9fb25edc28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2022:2003-1 Security update for mariadb

This update for mariadb fixes the following issues: Update to 10.5.16 bsc1199928: - CVE-2021-46669 bsc1199928 - CVE-2022-27376 bsc1198628 - CVE-2022-27377 bsc1198603 - CVE-2022-27378 bsc1198604 - CVE-2022-27379 bsc1198605 - CVE-2022-27380 bsc1198606 - CVE-2022-27381 bsc1198607 - CVE-2022-27382...

Denial Of Service (DoS)

trilogy is vulnerable to denial of service. When authenticating a malicious server, an attacker can send a specially crafted malicious authentication packet to the protocol.c as it does not properly verify the exact length of the authdatalen...