CVE-2022-40468

CVE-2022-40468 affects tinyproxy. The issue is a potential leak of left-over heap data when using custom error page templates with non-standard variables, caused by uninitialized buffers in process_request() and related header handling. Multiple advisories confirm risk across distros, including D...

nodejs-underscore: Arbitrary code execution via the template function

A flaw was found in nodejs-underscore. Arbitrary code execution via the template function is possible, particularly when a variable property is passed as an argument as it is not sanitized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

State variables written after the call

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The external function burn updates state variables balance0 and balance1 after safeTransfer has been called. This could potentially be exploited as an attacker could call the burn function multiple time...

Information Disclosure

podman is vulnerable to information disclosure. The vulnerability exists due to an incorrect version of podman missing for the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056 allowing an attacker to gain access to sensitive information stored in environment variables...

Reflected XSS via POST

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

CVE-2022-2739

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive...

CVE-2022-2739

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive...

PT-2022-18405 · Red Hat · Podman

Name of the Vulnerable Software and Affected Versions: podman versions prior to the version fixed via RHSA-2020:5056 Description: The issue could possibly allow an attacker to gain access to sensitive information stored in environment variables, such as those defined by environment variable...

Reentrancy in repayLoan

Lines of code Vulnerability details Reentrancy in repayLoan Impact token.safeTransferFrom is called and after that state with the value is calcualted, if token can be a wrong or compromised contract this would lead to a clasic reentrancy attack that would transfer more from the balance than...

MAL-2022-7424 Malicious code in free-net-vpn2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 918a0f985a93815d37d9480f97dd5203b78834142904ae50550bd431ca52c05b Security researchers at Check Point Research discovered a malicious package called free-net-vpn2 that targets environment variables. PyPI has since remov...

Malicious code in free-net-vpn2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 918a0f985a93815d37d9480f97dd5203b78834142904ae50550bd431ca52c05b Security researchers at Check Point Research discovered a malicious package called free-net-vpn2 that targets environment variables. PyPI has since remov...

MAL-2022-7423 Malicious code in free-net-vpn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7c578ebbd5b9dea94fedafe257ab0b885731b9f32789b9d9a2708193ef03995 Security researchers at Check Point Research discovered a malicious package called free-net-vpn that targets environment variables. PyPI has since remove...

Malicious code in free-net-vpn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7c578ebbd5b9dea94fedafe257ab0b885731b9f32789b9d9a2708193ef03995 Security researchers at Check Point Research discovered a malicious package called free-net-vpn that targets environment variables. PyPI has since remove...

Check the return of .call when sending Ether

Lines of code Vulnerability details Impact It's considered a best practice to always check the return of the transaction when sending Ether with .call, since it's possible for a tx failure due to external factors out of the contract control. Currently, the contract emits an event with the result...

PYSEC-2022-250

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-251

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-250

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-251

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-252

The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

Ubuntu: Security Advisory (USN-4442-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...