SUSE CVE-2022-31248

A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java...

Upgraded Q -> 3 from #154 [1675567996775]

Judge has assessed an item in Issue 154 as 3 risk. The relevant finding follows: Erc20Quest.withdrawFee can be called against a quest more than once function withdrawFee public onlyAdminWithdrawAfterEnd IERC20rewardToken.safeTransferprotocolFeeRecipient, protocolFee; The withdrawFee function does...

PYSEC-2023-39

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. isvalidethsignature is missing a call to finalizekeccak after calling verifyethsignature. As a result, any contract using isvalidethsignature from the...

Pandora 信任管理问题漏洞

Pandora is an analytics framework for discovering if a file is suspicious and displaying the results conveniently. A trust management issue vulnerability exists in Pandora FMS version v764, which stems from the presence of an incorrect authentication vulnerability that can be abused by an attacke...

PT-2023-36072

Name of the Vulnerable Software and Affected Versions Adyen affected versions not specified Description The issue concerns the is valid hmac and is valid hmac notification methods in Adyen's utility for validating notification HMAC signatures. These methods are susceptible to a timing attack. To...

bash: a heap-buffer-overflow in valid_parameter_transform

A flaw was found in the bash package, where a heap-buffer overflow can occur in validparametertransform. This issue may lead to memory problems...

Information disclosure

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull...

CVE-2022-3738 WAGO: Missing authentication for config export functionality in multiple products

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull...

GSD-2023-1000963 drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()

drm/sti: Fix return type of stidvo,hda,hdmiconnectormodevalid This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

PT-2023-33594

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.16 Description The issue is related to the return type of certain functions in the Linux Kernel, specifically sti dvo connector mode valid, sti hda connector mode valid, and sti hdmi connector mode valid. Th...

PT-2023-34083

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description The issue concerns a function mtk hdmi bridge mode valid with an incorrect return type. The actual impact and potential for attack have not been proven yet. Recommendations For versions prior...

PT-2023-34041 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.86 Description: The issue concerns a function fsl dcu drm connector mode valid with an incorrect return type. The actual impact and potential for attack have not been proven. Recommendations: For Linux...

PT-2023-34040

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.86 Description The issue concerns a fix in the return type of certain functions, specifically sti dvo connector mode valid, sti hda connector mode valid, and sti hdmi connector mode valid. The actual impact...

PT-2023-34622

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.337 Description The issue concerns a fix in the return type of the fsl dcu drm connector mode valid function. The actual impact and potential for attack have not been proven yet. Recommendations For Linux...

CVE-2022-3782

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within t...

CVE-2022-3782

CVE-2022-3782 affects Keycloak / Red Hat Single Sign-On: path traversal via double URL encoding due to improper validation of redirect URLs, enabling an attacker to traverse to arbitrary files within the domain when wildcard Redirect URIs are used. Connected sources confirm the issue and indicate...

CVE-2022-3782: Improper Limitation of a Pathname to a Restricted Directory

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within t...

编号撤回

This CVE number has been withdrawn...

CVE-2022-3715

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems...

PT-2022-8310 · Pilz · Pilz Pmc Programming Tool

Name of the Vulnerable Software and Affected Versions: Pilz PMC programming tool versions 3.x before 3.5.17 Description: An issue in the Pilz PMC programming tool allows an attacker to identify valid usernames. Recommendations: For versions prior to 3.5.17, update to version 3.5.17 or later to...