PT-2022-2872 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the Win32 Stream Enumeration component of Windows operating systems. This allows remote attackers to execute arbitrary code a...

PT-2022-2871 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to incorrect code generation management in the Win32 Stream Enumeration component of Windows operating systems. It allows remote attackers to execute arbitrary code and...

Buffer Overflow

Live555 is vulnerable to buffer overflow. The vulnerability exists because huge requests for the same MP3 stream, lead to recursion and s stack-based buffer over-read which allows an attacker to cause a denial of service...

DEBIAN-CVE-2022-0798

Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension...

Multiple Qualcomm products have vulnerabilities related to configuration errors

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits mainly semiconductor devices, but also passive components, etc., and from time to time fabricated on the surface of semiconductor wafers. Qualcomm A misconfiguration vulnerability exists in multiple products,...

org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.1.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.1.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.2.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.2.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.70, <=1.0.109), org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.0.release) +7 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

[SECURITY] Fedora 36 Update: expat-2.4.7-1.fc36

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

CVE-2022-0322

A flaw was found in the sctpmakestrresetreq function in net/sctp/smmakechunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUGON issue, leading to a denial of service DOS...

CVE-2022-0396

BIND 9.16.11 - 9.16.26, 9.17.0 - 9.18.0 and versions 9.16.11-S1 - 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSEWAIT status for an indefinite period of time, even after the client has terminated the connection...

CVE-2022-0396: Improper Resource Shutdown or Release

BIND 9.16.11 - 9.16.26, 9.17.0 - 9.18.0 and versions 9.16.11-S1 - 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSEWAIT status for an indefinite period of time, even after the client has terminated the connection...

[SECURITY] Fedora 35 Update: expat-2.4.7-1.fc35

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerabili...

OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerabili...

Denial Of Service (DoS)

bind is vulnerable to denial of service. The vulnerability exists due to a race condition where an attacker can cause the system to remain in CLOSEWAIT status for an indefinite period of time by injecting a maliciously crafted TCP stream...

CVE-2022-0396

A flaw was found in Bind that incorrectly handles certain crafted TCP streams. The vulnerability allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This flaw allows a remote attacker to send specially crafted TCP strea...

CVE-2022-27217

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-24739

alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is onl...

[SECURITY] Fedora 34 Update: libxml2-2.9.13-1.fc34

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...