PT-2022-19857 · Mitsubishi · Motion Control Setting +1

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric GX Works3 versions 1.000A through 1.087R Motion Control Setting GX Works3 related software versions 1.000A through 1.042U Description: The issue allows a remote unauthenticated attacker to disclose sensitive information. A...

SUSE-SU-2022:4201-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed bsc1187685...

SUSE-SU-2022:4194-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - CVE-2022-3964: Fixed out of bounds read in updateblockinprevframe bsc1205388...

OPENSUSE-SU-2022:10212-1 Security update for xtrabackup

This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history boo1170644 - CVE-2020-29488: Changes in how absolute paths are handled boo1205581...

OPENSUSE-SU-2022:10211-1 Security update for Botan

This update for Botan fixes the following issues: - CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses boo1205509...

Typora fails to properly neutralize JavaScript code.

Overview Typora fails to properly neutralize JavaScript code CWE-116. Eiji Mori of Flatt Security Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Opening a file with the affected product may lead to...

PT-2022-10889 · Hewlett Packard · Hp Command Center +1

Name of the Vulnerable Software and Affected Versions: OMEN Gaming Hub affected versions not specified HP Command Center affected versions not specified Description: A potential security issue has been identified that may allow escalation of privilege and/or denial of service. Recommendations: Fo...

MGASA-2022-0434 Updated varnish packages fix security vulnerability

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce...

DLA-3199-1 firefox-esr - security update

Bulletin has no description...

SUSE-SU-2022:4001-1 Security update for sudo

This update for sudo fixes the following issues: - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt password backend bsc1204986...

GHSA-M53V-5X5X-5M2P Concrete CMS vulnerable to Session Fixation

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

PT-2022-26945 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 6.0.3 Description: A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script. The developer provides new patched releases for all versions since 3.7. Recommendations: For...

ALSA-2022:7979 Low: speex security update

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates. Security Fixes: speex: divide by zero in readsamples via crafted WAV file CVE-2020-23903 For more details about the security issues, including the impact, a CVSS...

GSD-2022-1007570 drm: Prevent drm_copy_field() to attempt copying a NULL pointer

drm: Prevent drmcopyfield to attempt copying a NULL pointer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.296 by commit...

GSD-2022-1007038 wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

GSD-2022-1006787 ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller

ftrace: Fix recursive locking directmutex in ftracemodifydirectcaller This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

PT-2022-20307 · Insyde · Ihisismm Driver

Name of the Vulnerable Software and Affected Versions: IhisiSmm driver versions prior to Kernel 5.4: 05.44.23 IhisiSmm driver versions prior to Kernel 5.5: 05.52.23 Description: The issue allows DMA attacks on the parameter buffer used by the IhisiSmm driver to change the contents after parameter...

PT-2022-27049 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions prior to 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2 Description: The issue is related to Reflected XSS in the dashboard icons due to un-sanitized output. Recommendations: For Concrete CMS versions prior to 8.5.10,...

JVN#54728399: TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) vulnerable to ClassLoader manipulation

The past versions of TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java Rich are vulnerable to a ClassLoader manipulation vulnerability due to using the old version of Spring Framework which contains the vulnerability. According to the developer, this vulnerability is caused by ...

OPENSUSE-SU-2022:10198-1 Security update for varnish

This update for varnish fixes the following issues: Update to 7.2.1: - CVE-2022-45059: Fixed a HTTP request smuggling via hop-by-hop headers boo1205243. - CVE-2022-45060: Fixed a HTTP request forgery via character injection through HTTP/2 pseudo-headers boo1205242...