GSD-2023-1002417 nilfs2: fix underflow in second superblock position calculations

nilfs2: fix underflow in second superblock position calculations This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.306 by commit...

GSD-2023-1002382 s390/decompressor: specify __decompress() buf len to avoid overflow

s390/decompressor: specify decompress buf len to avoid overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.169 by commit...

U.S. Dept Of Defense: Unauthenticated Blind SSRF at https://█████ via xmlrpc.php file

An unauthenticated blind SSRF vulnerability was discovered on the xmlrpc.php file at a certain endpoint, allowing an attacker to send requests to external URLs and potentially conduct further attacks. Input validation and filtering are recommended to prevent such attacks in the future...

USN-5903-1 lighttpd vulnerabilities

It was discovered that lighttpd incorrectly handled certain inputs, which could result in a stack buffer overflow. A remote attacker could possibly use this issue to cause a denial of service DoS. CVE-2022-22707, CVE-2022-41556...

CVE-2023-24651

Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page...

GSD-2023-1002270 f2fs: let's avoid panic if extent_tree is not created

f2fs: let's avoid panic if extenttree is not created This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.271 by commit...

GSD-2023-1002246 x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL

x86/i8259: Mark legacy PIC interrupts with IRQLEVEL This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.272 by commit...

GSD-2023-1002217 net/sched: sch_taprio: fix possible use-after-free

net/sched: schtaprio: fix possible use-after-free This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.231 by commit...

GSD-2023-1002185 net/sched: act_mpls: Fix warning during failed attribute validation

net/sched: actmpls: Fix warning during failed attribute validation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.164 by commit...

GSD-2023-1002176 Add exception protection processing for vd in axi_chan_handle_err function

Add exception protection processing for vd in axichanhandleerr function This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1002166 drm/amd/display: Calculate output_color_space after pixel encoding adjustment

drm/amd/display: Calculate outputcolorspace after pixel encoding adjustment This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.165 by commit...

GSD-2023-1002134 bpf: Skip task with pid=1 in send_signal_common()

bpf: Skip task with pid=1 in sendsignalcommon This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.167 by commit...

GSD-2023-1002101 tty: fix possible null-ptr-defer in spk_ttyio_release

tty: fix possible null-ptr-defer in spkttyiorelease This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.90 by commit...

GSD-2023-1001974 Add exception protection processing for vd in axi_chan_handle_err function

Add exception protection processing for vd in axichanhandleerr function This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.8 by commit...

GSD-2023-1001944 IB/hfi1: Immediately remove invalid memory from hardware

IB/hfi1: Immediately remove invalid memory from hardware This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit...

GSD-2023-1001917 bnxt: Do not read past the end of test names

bnxt: Do not read past the end of test names This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit...

GSD-2023-1001892 erofs/zmap.c: Fix incorrect offset calculation

erofs/zmap.c: Fix incorrect offset calculation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.10 by commit...

GSD-2023-1001865 mm: multi-gen LRU: fix crash during cgroup migration

mm: multi-gen LRU: fix crash during cgroup migration This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.11 by commit...

XSS via postMessage to deface any website and account takeover

Description Hey Chatwoot team, while looking for vulnerabilities I found a critical XSS which allow us to XSS/Deface any website which uses the chat, this can be automated to attack thousands of websites Vulnerable Code Inside this function...

We Don’t Just Patch – We Hack

We Don’t Just Patch – We Hack By Trellix · February 1, 2023 This blog was written by Douglas McKee If you have read any security advisories, technology news articles or even our very own Bug Report, you have continually been bombarded with the message to patch, patch, patch! Patching is critical ...