Exposure of Sensitive Information to an Unauthorized Actor in JGroup

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information diagnostic information and execute arbitrary code by reusing valid credentials...

GHSA-69CJ-G7MW-MH72 Jenkins Docker Commons Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid...

CVE-2022-29622

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are...

CVE-2022-29622

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are...

CVE-2022-29622

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are...

CVE-2022-29622

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are...

GHSA-QGFG-GVFF-523V python-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate

The Python client library for Glance python-glanceclient before 0.10.0 does not properly check the preverifyok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate and allows...

GHSA-Q4CQ-R7HG-PXQQ Improper Authentication in Jenkins

A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled...

Updated cifs-utils packages fix security vulnerability

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges. CVE-2022-27239 cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign...

libreoffice: Timestamp Manipulation with Signature Wrapping

A flaw was found in LibreOffice, where it inserted a signing timestamp. This flaw allows LibreOffice to present a valid signature due to the altered signing time. The highest threat from this vulnerability is to confidentiality and integrity...

CVE-2022-28161

An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode. To exploit this vulnerability, the attacker would need t...

Security Bulletin: IBM i components are vulnerable to data access due to CVE-2022-22481

Summary IBM Navigator for i - heritage version GUI is vulnerable to data access as described in the vulnerability details section. IBM has addressed the vulnerability for IBM Navigator for i - heritage version with a fix as described in the remediation/fixes section. Vulnerability Details...

PT-2025-8314

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17 Description A flaw in the F2FS file system support within the Linux kernel can lead to a denial of service. The issue occurs in the dec valid node count function located in fs/f2fs/f2fs.h. The root cause is...

GHSA-Q8J7-FJH7-25V5 Symfony collectionCascaded and collectionCascadedDeeply fields security bypass

When using the Validator component, if Symfony\Component\Validator\Mapping\Cache\ApcCache is enabled or any other cache implementing Symfony\Component\Validator\Mapping\Cache\CacheInterface, some information is lost during serialization the collectionCascaded and the...

BSA-2022-1840

Security Advisory ID : BSA-2022-1840 Component : debug mode Revision : 1.0 An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in...

DEBIAN-CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

UBUNTU-CVE-2022-29973

relan exFAT 1.3.0 allows local users to obtain sensitive information data from deleted files in the filesystem in certain situations involving offsets beyond ValidDataLength...

ALPINE-CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

Solar appScreener 代码问题漏洞

Solar appScreener is a static application security testing SAST tool from Solar appScreener, Inc. It is used to detect vulnerabilities and backdoors in binary and source code. A security vulnerability exists in Solar appScreener 3.10.4 and prior versions that originates from an XXE and SSRF attac...

O365-Doppelganger - A Quick Handy Script To Harvest Credentials Off Of A User During A Red Team And Get Execution Of A File From The User

O365-Doppelganger is NOT a replacement for hardcore phishing activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger. O365-Doppelganger is a quick handy script to harvest credentials of a user during Red Teams. This repository is a...