Emergency Alert System Flaws Could Let Attackers Transmit Fake Messages

The U.S. Department of Homeland Security DHS has warned of critical security vulnerabilities in Emergency Alert System EAS encoder/decoder devices. If left unpatched, the issues could allow an adversary to issue fraudulent emergency alerts over TV, radio, and cable networks. The August 1 advisory...

OPENSUSE-SU-2022:10075-1 Security update for python-jupyterlab

This update for python-jupyterlab fixes the following issues: Update to 2.2.10: Remove form tags' action attribute during sanitizing, to prevent an XSS CVE-2021-32797 boo1196663 Header ‘Content-Type’ should not be overwritten Do not use token parameters in websocket urls Properly handle errors in...

Malicious code in npm-dependency-submission-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ad151e37604b229dbad34a65d41f3ddfeb26db05249d3b5216635b725b7527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-31186

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

Information disclosure

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

GSD-2022-1004930 dm raid: fix KASAN warning in raid5_add_disks

dm raid: fix KASAN warning in raid5adddisks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.322 by commit...

GSD-2022-1004803 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.252 by commit...

GSD-2022-1004714 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.205 by commit...

GSD-2022-1004612 dm raid: fix KASAN warning in raid5_add_disks

dm raid: fix KASAN warning in raid5adddisks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.129 by commit...

GSD-2022-1004589 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.130 by commit...

GSD-2022-1004509 scsi: mpt3sas: Fix out-of-bounds compiler warning

scsi: mpt3sas: Fix out-of-bounds compiler warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.49 by commit...

GSD-2022-1004447 dm raid: fix KASAN warning in raid5_add_disks

dm raid: fix KASAN warning in raid5adddisks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.53 by commit...

GSD-2022-1004317 scsi: mpt3sas: Fix out-of-bounds compiler warning

scsi: mpt3sas: Fix out-of-bounds compiler warning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

GSD-2022-1004310 netfs: gcc-12: temporarily disable '-Wattribute-warning' for now

netfs: gcc-12: temporarily disable '-Wattribute-warning' for now This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

GSD-2022-1004288 netfs: Fix gcc-12 warning by embedding vfs inode in netfs_i_context

netfs: Fix gcc-12 warning by embedding vfs inode in netfsicontext This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit...

GSD-2022-1004204 dmaengine: pl330: Fix lockdep warning about non-static key

dmaengine: pl330: Fix lockdep warning about non-static key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.11 by commit...

Criminals using compromised social media accounts to “post indecent images of children” says UK cybercrime organization

Action Fraud, the UKs national reporting center for fraud and cybercrime, is warning of a very disturbing scam involving social media and "indecent images of children." Details are light, but social media fans should take this as a warning to lock down their accounts immediately. Criminals are...

openSUSE: Security Advisory for logrotate (SUSE-SU-2022:2547-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...