SUSE-SU-2022:2838-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: Updated to Intel CPU Microcode 20220809 release bsc1201727: - CVE-2022-21233: Fixed an issue where stale data may have been leaked from the legacy xAPIC MMIO region, which could be used to compromise an SGX enclave INTEL-SA-00657. See also:...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2022-2228)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-36190

GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gfisomdoviconfigget. This vulnerability was fixed in commit fef6242...

Null pointer dereference

A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gffilterpidsetpropertyfull at filtercore/filterpid.c:5250,which causes a Denial of Service DoS. This vulnerability was fixed in commit b43f9d1...

CVE-2022-36186

Removed by vendor...

SUSE-SU-2022:2825-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2022-29154: Fixed an arbitrary file write when connecting to a malicious server bsc1201840...

Server side request forgery (ssrf)

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF Server-side Request Forgery when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici =...

PT-2022-18568 · Sourcecodester · Sourcecodester Simple Online Book Store System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Online Book Store System affected versions not specified Description: A critical issue was found in the system, affecting an unknown function of the file /obs/book.php. The manipulation of the bookisbn argument leads to...

SUSE-SU-2022:2723-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-36557: Fixed race condition between the VTDISALLOCATE ioctl and closing/opening of ttys that could lead to a use-after-free bnc1201429. - CVE-2020-3655...

CVE-2022-36125

It is possible to crash panic an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 previously known as avro-rs. Users should update to apache-avro version 0.14.0 which addresses this issue...

Security Bulletin: IBM Netezza for Cloud Pak for Data is vulnerable to CVE-2022-0811

Summary IBM Netezza for Cloud Pak for Data is vulnerable to arbitrary code execution as root on the cluster node due to CVE-2022-0811 although severity is low. Vulnerability is addressed by upgrading OCP version to 4.8.42. Vulnerability Details CVEID:CVE-2022-0811 DESCRIPTION: CRI-O could allow a...

PT-2022-22863 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad version 5.2.0 Description: The issue is related to Incorrect Access Control in Zammad, where the software did not correctly perform authorization on certain attachment endpoints. This could be exploited by an unauthenticated attacker t...

Security update for caddy (moderate)

openSUSE Security Update: Security update for caddy Announcement ID: openSUSE-SU-2022:10080-1 Rating: moderate References: 1201822 Cross-References: CVE-2022-34037 CVSS scores: CVE-2022-34037 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 A...

Raneto vulnerable to Cross-site Scripting

Renato v0.17.0 was discovered to contain a cross-site scripting XSS vulnerability. This issue is fixed in version 0.17.1...

Security Bulletin: IBM Sterling Connect:Direct for UNIX Certified Container is affected by denial of service vulnerability in version 1.1.1k-5

Summary IBM Sterling Connect:Direct for UNIX Certified Container requires openssl for LDAP support. This fix upgrades the openssl and its compnent packages to version 1.1.1k-6.el85 Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a fla...

PT-2022-17860 · Sourcecodester · Sourcecodester Garage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Garage Management System affected versions not specified Description: A vulnerability has been found in the SourceCodester Garage Management System, affecting an unknown functionality of the file edituser.php. The manipulation ...

PT-2022-17931 · Sourcecodester · Sourcecodester Multi Language Hotel Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Multi Language Hotel Management Software affected versions not specified Description: A critical issue has been discovered, allowing for SQL injection through the manipulation of the email argument. This can be exploited...

openSUSE: Security Advisory for samba (SUSE-SU-2022:2651-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:2654-1 Security update for u-boot

This update for u-boot fixes the following issues: - CVE-2022-34835: Fixed stack buffer overflow vulnerability in i2c md command bsc1201214...

SUSE-SU-2022:2653-1 Security update for u-boot

This update for u-boot fixes the following issues: - CVE-2022-33967: Fixed heap overflow in squashfs filesystem implementation bsc1201745. - CVE-2022-34835: Fixed stack buffer overflow vulnerability in i2c md command bsc1201214...