CVE-2022-31079: Uncontrolled Resource Consumption

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size o...

XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Fedora: Security Advisory for golang-github-francoispqt-gojay (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2022-37072

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type known as Memcpy-param-overlap. The crash occurs in the following functions: FT Stream TryRead, bdf load font, and BDF...

[SECURITY] Fedora 36 Update: golang-github-francoispqt-gojay-1.2.13-7.fc36

GoJay is a performant JSON encoder/decoder for Golang currently the most performant, see benchmarks. It has a simple API and doesn't use reflection. It relies on small interfaces to decode/encode structures and slices. Gojay also comes with powerful stream decoding features and an even faster...

[SECURITY] Fedora 36 Update: commit-stream-0.1.2-7.fc36

OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API...

GHSA-M43H-HFRQ-X8WX SystemDS CPU exhaustion vulnerability

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

SystemDS CPU exhaustion vulnerability

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a...

OGG Core Library Full Control

The vulnerability of the OGG Core Library, a data stream management tool of Oracle GoldenGate, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2022-31017

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...

CVE-2022-31017

Zulip Server contains a logic error in versions 2.1.0 through 5.2 where a private stream with protected history, upon edits, erroneously causes an API event that includes the edited message to all current subscribers. The issue stems from the server sending the edited message via an API event to ...

CVE-2022-31017: Expression is Always True

Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...

PT-2022-20461

Name of the Vulnerable Software and Affected Versions Zulip versions 2.1.0 through 5.2 Description The issue is related to a logic error in Zulip, an open-source team collaboration tool. When a stream configured as private with protected history is edited, the server incorrectly sends an API even...

Redis streamGetEdgeID Data Compromise

The vulnerability of the streamGetEdgeID function in the Redis database management system is related to insufficient validation of input data. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and accessibility of data...

UBUNTU-CVE-2022-33105

Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID...

Malicious Package

Overview node-red-contrib-aws-stream-manager is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerab...

Malicious Package

Overview red-contrib-aws-stream-manager is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Redis Labs Redis security vulnerabilities

Redis Labs Redis is an open source, web-enabled, memory-based, persistent logging, key-value Key-Value storage database written in ANSI C, with a multi-language API, from Redis Labs. A security vulnerability exists in Redis, which stems from the discovery that Redis v7.0 contains a memory leak vi...

Malicious code in @zipmex/events-stream-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b626ed2ba8317a3c709a45a9d17f5ef193b73c0b157c6dc10c88a6c9a08cc513 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-794 Malicious code in @zipmex/events-stream-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b626ed2ba8317a3c709a45a9d17f5ef193b73c0b157c6dc10c88a6c9a08cc513 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...