The vulnerability of the `cgroup1_parse_param` function in the kernel/cgroup/cgroup-v1.c file of the Linux operating system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the cgroup1parseparam function in the kernel/cgroup/cgroup-v1.c file of the Linux operating system is related to the lack of checks to ensure that the source parameter is indeed a string. Exploiting this vulnerability could allow an attacker to access confidential data,...

NounsDAOLogicV2's state() and proposals() will use initial dynamic params for all V1 proposals

Lines of code Vulnerability details state and proposals call quorumVotesid that utilize initial dynamic params for all V1 proposals by misusing 0 as a proposal creation block. I.e. new field is referenced while it is zero for all V1 proposals. This way all V1 proposals will use the same initial s...

GO-2022-0564 Signature forgery in github.com/biscuit-auth/biscuit-go

An attacker can forge Biscuit v1 tokens with any access level. There is no known workaround for Biscuit v1. The Biscuit v2 specification avoids this vulnerability...

PT-2022-6404 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p2 and earlier Adobe Commerce versions 2.3.7-p3 and earlier Adobe Commerce versions 2.4.4 and earlier Description: The issue is related to insufficient input validation, allowing a remote attacker to potentially...

Unbreakable Enterprise kernel security update

4.1.12-124.65.1 - cgroup-v1: Require capabilities to set releaseagent Eric W. Biederman Orabug: 33825689 CVE-2022-0492 - ocfs2: kill EBUSY from dlmfsevictinode Junxiao Bi Orabug: 34091904 - ocfs2: dlmfs: fix error handling of userdlmdestroylock Junxiao Bi via Ocfs2-devel Orabug: 34091904 - ocfs2:...

EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2022-2200)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driv...

Frequent price update make the project vulnerable to price oracle manipulation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Frequent price update make the project vulnerable to price oracle manipulation Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof...

Malicious code in service-bus-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31858bdcfbb3924248460b003094be153f39da14723789001495407f920c6b86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6027 Malicious code in service-bus-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31858bdcfbb3924248460b003094be153f39da14723789001495407f920c6b86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in free-fortnite-skins-api-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3147 Malicious code in free-fortnite-skins-api-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84adc7f3e89bcdaf2440857943395002466913468cf0aed35f78e5879eaf84d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in free-fire-diamonsd-hakc-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01dd727b615eda36a111eed448a3e95546f23e6f60533ecf10c2b80404bff3e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3840 Malicious code in ing-web-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe142cd2d72a18a133fe6108f27a51f49d27b4afc2942e0acf271d7959d85ce9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5672 Malicious code in react-select-v1-deprecated (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d29d5cb498fe3472e1d7bf13f449cf73407728a4f7493ee3ccd8af301c71308 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

CVE-2022-29525

Rakuten Casa version APFV141 or APFV200 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an arbitrary operation...

PT-2022-19180 · Rakuten · Rakuten Casa

Name of the Vulnerable Software and Affected Versions: Rakuten Casa versions AP F V1 4 1 through AP F V2 0 0 Description: The issue is related to improper access control, allowing a remote attacker to log in with root privilege and perform arbitrary operations if the product is in its default...

ASB-A-218836280

In cgroup1parseparam of cgroup-v1.c, there is a possible container breakout due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Important: Red Hat Security Advisory: kpatch-patch security update

An update is now available for Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel security and bug fix update

3.10.0-1160.66.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.9 - Update oraclekernel-sig-key...