PT-2023-33608 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v4.19 through v6.0.16 Description: A memory leak issue was discovered, which may have potential security implications. The issue was introduced in version v4.19 and is fixed in version v6.0.17. Recommendations: For Linux...

PT-2023-33967 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: A memory leak issue exists in the Linux Kernel. The issue was introduced in version v4.9 and is fixed in version v5.15.87. Recommendations: For versions prior to v5.15.87, update to version...

GSD-2022-1008087 bpf: Fix wrong reg type conversion in release_reference()

bpf: Fix wrong reg type conversion in releasereference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.155 by commit...

CVE-2022-43553

A remote code execution vulnerability in EdgeRouters Version 2.0.9-hotfix.4 and earlier allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later...

UBUNTU-CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

Stack overflow

TensorFlow is an open source platform for machine learning. If tf.rawops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56...

PT-2022-37526 · Vsftpd · Vsftpd

Name of the Vulnerable Software and Affected Versions: vsftpd affected versions not specified Description: The issue concerns the removal of unsupported systemd hardening options. No information is provided about the estimated number of potentially affected devices or real-world incidents where...

PT-2022-36710 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Stack-use-after-return READ 4. The crash state involves several functions, including gs type2 interpre...

CVE-2022-39349 Tasks.org vulnerable to data exfiltration by malicous app or adb

The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity ShareLinkActivity.kt to handle "share" intents coming from other components in the same device and convert them to tasks. Those intents may contain arbitrary file paths as attachment...

CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details

@dependencytrack/frontend is a Single Page Application SPA used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of providing vulnerability details in markdown format, the...

CVE-2022-39310 Malicious agent may be able to impersonate another agent in GoCD

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive work packages for other agents due to...

GSD-2022-1006343 sch_sfb: Don't assume the skb is still around after enqueueing to child

schsfb: Don't assume the skb is still around after enqueueing to child This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...

CVE-2022-39232 Discourse vulnerable to incomplete quote causing a topic to crash in the browser

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete...

DEBIAN-CVE-2022-39254

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room ke...

CVE-2022-44010

A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted HTTP request to the HTTP Endpoint listening on port 8123 by default, causing a heap-based buffer overflow that crashes the ClickHouse server process. This attack does not require...

PT-2022-34234 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.14 through 5.4.210 Description: The issue is related to error handling in the adminq component. It was introduced in version v3.14 and fixed in version v5.4.211. The actual impact and attack plausibility have not yet...

PT-2022-33784 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15.47 through v5.15.62 Description: A use-after-free bug was found in the NFSv4/pnfs component. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.15.47 and is...

CVE-2022-35939 Out of bounds write in `scatter_nd` op in TensorFlow Lite

TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have...

PT-2022-33234 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.8 Description: A memory corruption issue was discovered, potentially leading to security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This issue was introduced in...

CVE-2022-36101 Sensitive data in backend customer module

Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update an...