com.blazebit:blaze-storage-client-keycloak (>=0.2.0 <=0.3.3), com.blazebit:blaze-storage-modules-authentication-keycloak (>=0.2.0 <=0.3.3) +257 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (>=1.0-alpha-1 <=1.9.8.Final)

org.keycloak:keycloak-core MAVEN version =1.0-alpha-1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.8.4, =0.2.1, =0.13, =1.1.0.Final, =1.2.2.Final, =1.2.2.Final, =1.0.0.Beta2, =1.2.1.Final, =1.1.2.Final, =1.1.0.Final, =1.2.1.Final and more Source cves: CVE-2022-0225 Source advisory: OSV:GHSA-755V-R4X4-QF7M...

UBUNTU-CVE-2022-41912

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version...

CVE-2022-41921 Discourse chat messages should have a maximum character limit

Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial of service for other users when posting huge amounts of text. Users should upgrade to version 2.9.0.beta13, where a limit has been...

AZL-44820 CVE-2022-41940 affecting package js-jquery 3.5.0-4

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io...

CVE-2022-41952 Uncontrolled Resource Consumption in Matrix Synapse

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize default: 10M bytes have been downloaded, which can in some cases lead to...

CVE-2022-41952 Uncontrolled Resource Consumption in Matrix Synapse

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize default: 10M bytes have been downloaded, which can in some cases lead to...

CVE-2022-41936 Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The modifications rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the modifications rest...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds in DynamicStitch due to missing validation when it receives a differing number of inputs, such as when it is called with an indices size 1 and a data size 2. Remediation Upgrade tensorflow-lite to version 2.12.0 or higher...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference because the pywrap code fails to parse the tensor and returns a nullptr if a list of quantized tensors is assigned to an attribute. Remediation Upgrade tensorflow-lite to version 2.12.0 or higher. References -...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

PT-2022-7189 · WordPress · Welcart Ecommerce Plugin

Name of the Vulnerable Software and Affected Versions: Welcart eCommerce plugin versions = 2.7.7 Description: The issue is related to incorrect restriction of a directory path with limited access in the Welcart eCommerce plugin for WordPress. This can allow a remote attacker to execute arbitrary...

Security Advisory for Ivanti Endpoint Manager Client-CVE-2022-27773

SECURITY ADVISORY 2022-11-16 Product Affected: Ivanti EPM Endpoint Manager PROBLEM: A vulnerability was recently discovered for Ivanti Endpoint Manager Client. Vulnerability InformationCVE| CVSS| Summary ---|---|--- CVE-2022-27773CVE | High - CVSS=7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | An issu...

UBUNTU-CVE-2022-39320

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send i...

UBUNTU-CVE-2022-41916

Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC via PKINIT and kinit via PKINIT, as well as any third-party applications using Heimdal's...

CVE-2022-41917 Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a...

CVE-2022-41916 Read one byte past a buffer when normalizing Unicode

Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC via PKINIT and kinit via PKINIT, as well as any third-party applications using Heimdal's...

PT-2022-35829 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.296 Description: The issue is related to the Bluetooth L2CAP protocol in the Linux Kernel. It involves the initialization of delayed works at the l2cap chan create function. The actual impact and attack...

PT-2022-35828 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.296 Description: The issue arises when the code attempts to access the sk wq of a socket sock that is already dead. This could potentially lead to security vulnerabilities, although the actual impact and...

PT-2022-35334 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.15.49 through 5.15.74 Description: The issue is related to the ftrace module in the Linux Kernel, specifically with module PLTs and mcount. The actual impact and attack plausibility have not yet been proven...

PT-2022-35037 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.3 Description: The issue is related to the ACPI tables, specifically the FPDT, where a function call is made on an invalid physical address. The actual impact and potential for attack have not been proven...