isolated-vm has vulnerable CachedDataOptions in API

Impact If the untrusted v8 cached data is passed to the API through CachedDataOptions, the attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept cachedData payloads from a user...

Arbitrary Code Execution

isolated-vm is vulnerable to arbitrary code execution. The vulnerability exists because v8 cache data is not properly restricted in CachedDataOptions which allows an attacker to inject and execute arbitrary code...

CVE-2022-39266

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7...

Design/Logic Flaw

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7...

CVE-2022-39266 isolated-vm has vulnerable CachedDataOptions in API

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7...

CVE-2022-39266 isolated-vm has vulnerable CachedDataOptions in API

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7...

CVE-2022-39266

CVE-2022-39266 affects the isolated-vm library for Node.js. The root cause is that in versions up to 4.3.6, passing untrusted V8 cached data via CachedDataOptions can bypass the sandbox and allow arbitrary code execution in the Node.js process. Multiple connected documents confirm the issue and p...

CVE-2022-39266 isolated-vm has vulnerable CachedDataOptions in API

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7...

Marcel Laverdet isolated-vm 安全漏洞

Marcel Laverdet isolated-vm is a Marcel Laverdet open source application. Library for nodejs with access to v8's Isolate interface. A security vulnerability exists in Marcel Laverdet isolated-vm version 4.3.6 and earlier, which stems from a vulnerability that allows users to access v8's Isolate...

openSUSE 15 Security Update : virtualbox (openSUSE-SU-2022:10129-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10129-1 advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is...

GHSA-4456-W38R-M53X Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

Besu VM vulnerable to gas allocation error in CALL operations

Impact An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in th...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Asset and Service Management

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 5, 6, 7, and 8 that are used by Maximo Asset Management, Maximo Asset Management Essentials, Maximo Asset Management for Energy Optimization, Maximo Industry Solutions including Maximo for Government, Maximo...

Mageia: Security Advisory (MGASA-2022-0342)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2022-0342 Updated open-vm-tools packages fix security vulnerability

A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine CVE-2022-31676...

Updated open-vm-tools packages fix security vulnerability

A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine CVE-2022-31676...

CVE-2022-26873

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines VMs and bypassing memory isolation and...

CVE-2022-40246

A potential attacker can write one byte by arbitrary address at the time of the PEI phase only during S3 resume boot mode and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines V...

Memory corruption

A potential attacker can write one byte by arbitrary address at the time of the PEI phase only during S3 resume boot mode and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines V...

Memory corruption

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines VMs and bypassing memory isolation and...