Fedora: Security Advisory for redis (FEDORA-2022-de7b3ceca6)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PT-2022-37306 · Git +1 · Lcms

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves FileWrite, cmsWriteUInt16Number, and Type MLU Write. No...

CVE-2022-38061

Authenticated author+ CSV Injection vulnerability in Export Post Info plugin = 1.2.0 at WordPress...

HashiCorp Vault vulnerable to incorrect metadata access

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checkin...

numTokensReservedForVesting is not compared with contract balance

Lines of code Vulnerability details Impact In VTVLVesting contract, the claims are created without comparing the numTokensReservedForVesting variable to the contract balance. If the sum of all user vesting tokens is below this param then the contract will be insolvent to be withdrawn. Proof of...

HashiCorp Vault 安全漏洞

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. A security vulnerability exists in HashiCorp Vault and Vault Enterprise versions 1.8.0 through 1.11.2 that stems from an issue with checking for the correct alias assigned to an entity, Vault may overwrite metada...

CVE-2022-40186

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checkin...

Security Bulletin: A security vulnerability in Nodejs unset-value affects IBM Cloud Pak for Multicloud Management Managed Services

Summary A security vulnerability in Nodejs unset-value affects IBM Cloud Pak for Multicloud Management Managed Services Vulnerability Details IBM X-Force ID: 220063 DESCRIPTION: Node.js unset-value module is vulnerable to a denial of service, caused by a prototype pollution flaw in the unset...

The vulnerability of the software used to create 3D computer graphics in Blender, related to integer overflow, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the software used to create three-dimensional computer graphics in Blender is related to the lack of checks for values less than 0. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2022-38333

Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function headervalue. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...

OpenWrt 缓冲区错误漏洞

OpenWrt is a Linux operating system for embedded devices. A security vulnerability exists in OpenWrt versions prior to v21.02.3, v22.03.0-rc6, which stems from the inclusion of two skip loops in the function headervalue, which can be exploited by an attacker to access sensitive information via a...

Early contributor can always become majority of crowdfund leading to rugging risks.

Lines of code Vulnerability details Description Voting power is distributed to crowdfund contributors according to the amount contributed divided by NFT purchase price. Attacker can call the buy function of BuyCrowdfund / CollectionBuyCrowdfund, and use only the first X amount of contribution fro...

PT-2022-4871 · Openwrt · Openwrt

Name of the Vulnerable Software and Affected Versions: Openwrt versions prior to 21.02.3 Openwrt version 22.03.0-rc6 Description: The issue is related to a buffer overflow vulnerability in the header value function, which allows attackers to access sensitive information via a crafted HTTP request...

GSD-2022-1006091 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1005949 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commit...

GSD-2022-1005523 bpf: Don't reinit map value in prealloc_lru_pop

bpf: Don't reinit map value in prealloclrupop This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1005464 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1004990 arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level

arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fwlevel This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.7 by...

CVE-2022-40762

A Memory Allocation with Excessive Size Value vulnerablity in the TEERealloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service DoS by invoking the function TEERealloc with an excessive number for the parameter len...

CVE-2022-40757

A Buffer Access with Incorrect Length Value vulnerablity in the TEEMACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service DoS by invoking the function TEEMACComputeFinal with an excessive size value of messageLen...