CVE-2022-47419 Mayan EDMS Tag XSS

An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system...

CVE-2022-47419

CVE-2022-47419 affects Mayan EDMS DMS with a reflected XSS in the in-product tagging system. The CVSS 3.1 base score is 5.4 (MEDIUM) with network attack vector, low attack complexity, require low privileges and user interaction. Exploitation observed per GHSA-5M6V-2XGF-QHRW and OSV details; no au...

memos 跨站脚本漏洞

memos is an open source hosted memo center with knowledge management and social features. memos versions prior to 0.10.0 have a cross-site scripting vulnerability that stems from the fact that it allows link tagging without validation, which could be exploited by an attacker to implement cross-si...

Implement Risk-Based Vulnerability Management with Qualys TruRisk™ : Part 1

For today’s CISOs, managing cyber risk is Job 1 priority, and it’s a full-time concern. Security practitioners are spending a considerable amount of time responding to cybersecurity threats and finding ways to reduce risk from threats that are unknown. Earlier this year Qualys introduced Qualys...

kernel: bpf: Fix a btf decl_tag bug when tagging a function

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a btf decltag bug when tagging a function syzbot reported a btf decltag bug with stack trace below: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 1 PREEMPT SMP KASAN KASAN:...

PT-2022-35395 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.76 Description: The issue concerns the initialization of registers in the arm64 architecture, specifically related to the Memory Tagging Extension MTE feature. The actual impact and potential for attacks...

PT-2022-35159 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue concerns the initialization of registers in the arm64 architecture, specifically related to the MTE Memory Tagging Extension feature. The actual impact and potential for attacks hav...

PT-2022-35158 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.14 through v6.0.2 Description: The issue is related to the arm64 architecture and Memory Tagging Extensions MTE in the Linux Kernel. It involves avoiding the setting of PG mte tagged if no tags are cleared or restored...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the name attribute in edittaggingtag.php, allowing an attacker to inject and execute malicious javascript...

PT-2022-33403 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19 through v5.19.3 Description: The issue concerns a potential security vulnerability in the Linux Kernel. It is related to the dsa: felix component and involves suppressing non-changes to the tagging protocol. The...

PT-2022-33594 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the arm64 kernel and the Memory Tagging Extension MTE. It involves the page tag in page-flags not being reset properly. The actual impact and potential for attack hav...

MAL-2022-902 Malicious code in ai-image-tagging-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec8ef7b0545eaa94432484debf73c757fbdcb6c21231a5a250f30afac3c5a8eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ai-image-tagging-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec8ef7b0545eaa94432484debf73c757fbdcb6c21231a5a250f30afac3c5a8eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AirTag stalking: What is it, and how can I avoid it?

More voices are being raised against the use of everyday technology repurposed to attack and stalk people. Most recently, its reported that Ohio has proposed a new bill in relation to electronic tagging devices. The bill, aimed at making short work of a loophole allowing people with no stalking o...

GHSA-R8RW-XX57-M64Q Cross-Site Request Forgery in Jenkins Git Plugin

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record...

CVE-2022-1545

It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note...

PT-2022-13946 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 13.2 through 14.8.5 Gitlab CE/EE versions 14.9 through 14.9.3 Gitlab CE/EE versions 14.10 through 14.10.0 Description: The issue allows disclosure of details of confidential notes created via the API if an unauthorized...

GHSA-6CJ8-C359-P7Q9 Drupal vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

GSD-2022-1001235 bpf: Fix a btf decl_tag bug when tagging a function

bpf: Fix a btf decltag bug when tagging a function This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

Google takes on Docs notification spammers

Cloud-based document suites have always been a hot target for scammers. When it’s easy to dip in and out for collaboration purposes, or just share things generally, then its likely that bad people will want in on the action. In 2019, Google calendar users were wading through endless spam...