GSD-2022-1001521 RDMA/mlx5: Fix memory leak in error flow for subscribe event routine

RDMA/mlx5: Fix memory leak in error flow for subscribe event routine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001205 RDMA/mlx5: Fix memory leak in error flow for subscribe event routine

RDMA/mlx5: Fix memory leak in error flow for subscribe event routine This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

PT-2022-30515

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.189 Description A memory leak issue exists in the RDMA/mlx5 component, specifically in the error flow for the subscribe event routine. The actual impact and potential for attack have not been fully determine...

PT-2022-30353

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.110 Description A memory leak issue exists in the RDMA/mlx5 component, specifically in the error flow for the subscribe event routine. The actual impact and potential for attack have not been fully...

PT-2022-29794

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description A memory leak issue exists in the RDMA/mlx5 component, specifically in the error flow for the subscribe event routine. The actual impact and attack plausibility of this issue have not yet bee...

PT-2022-29478

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.3 through v5.17.1 Description A memory leak issue exists in the RDMA/mlx5 component, specifically in the error flow for the subscribe event routine. The actual impact and potential for attack have not been fully...

CometD 安全漏洞

CometD is an extensible WebSocket and HTTP-based event and message routing bus for the CometD community. A security vulnerability in CometD in any version prior to 5.0.11, 6.0.6, and 7.0.6 stems from the fact that internal use of the Oort and Seti channels is not properly authorized, so any remot...

Multilist Subscribe for Sendy <= 1.6.1 - Subscriber+ Arbitrary Options Update

The plugin is using an outdated version of the Freemius library 1.2.2.9, which is known to be affected by a security issue allowing any authenticated users, such as subscriber to set arbitrary blog options As any authenticated user: Enable new user registrations:...

Multilist Subscribe for Sendy <= 1.6.1 - Subscriber+ Arbitrary Options Update

The plugin is using an outdated version of the Freemius library 1.2.2.9, which is known to be affected by a security issue allowing any authenticated users, such as subscriber to set arbitrary blog options PoC As any authenticated user: Enable new user registrations:...

WordPress Multilist Subscribe for Sendy plugin <= 1.6.1 - Subscriber+ Arbitrary Options Update vulnerability

Subscriber+ Arbitrary Options Update vulnerability discovered by 0xdecafbad in WordPress Multilist Subscribe for Sendy plugin versions = 1.6.1. Solution Deactivate and delete. This plugin has been closed as of February 1, 2022 and is not available for download. This closure is temporary, pending ...

WordPress Multilist Subscribe for Sendy plugin <= 1.6.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Multilist Subscribe for Sendy plugin versions = 1.6.1. Solution No patched version available...

CVE-2021-24923 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24923

The CVE-2021-24923 issue affects the Sendinblue Newsletter, SMTP, Email marketing and Subscribe forms WordPress plugin, pre-3.1.25. The root cause is improper escaping of the sib-statistics-date parameter when it is output in an HTML attribute, leading to a Reflected Cross-Site Scripting (XSS) vu...

WordPress WP Optin Wheel plugin <= 1.3.4 - Subscribe+ Plugin Options Update (Toggle Wheel status, Update wheels) vulnerability

Subscribe+ Plugin Options Update Toggle Wheel status, Update wheels vulnerability discovered in WordPress WP Optin Wheel plugin versions = 1.3.4. Solution Update the WordPress WP Optin Wheel plugin to the latest available version at least 1.3.5...

Beers with Talos, Ep. #114: And then there were two...

Beers with Talos BWT Podcast episode No. 114 is now available. Download this episode and subscribe to Beers with Talos: Apple Podcasts Google Podcasts Spotify StitcherRecorded Dec. 9, 2021. If iTunes and Google Play aren't your thing, click here. We joked... This is only the beginning! Please vis...

WordPress Newsletter, SMTP, Email marketing and Subscribe plugin <= 3.1.30 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Newsletter, SMTP, Email marketing and Subscribe plugin versions = 3.1.30. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe plugin to the latest available version at least 3.1.31...

PT-2021-24328

Name of the Vulnerable Software and Affected Versions: wolfSSL wolfMQTT version 1.9 Description: The issue is a heap-based buffer overflow in the MqttClient DecodePacket function, which is called from MqttClient WaitType and MqttClient Subscribe. Recommendations: For wolfSSL wolfMQTT version 1.9,...

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

The plugin does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC...

WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin <= 3.1.24 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin versions = 3.1.24. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue plugin to the latest available...

PT-2021-24120

Name of the Vulnerable Software and Affected Versions: SiPass integrated versions 2.76 through 2.85 Siveillance Identity versions 1.5 through 1.6.283 Description: A vulnerability has been identified in the affected applications, where they insufficiently limit access to the internal message broke...