Reflected XSS in querystring parameters

An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request. To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload. This will only affect projects...

GHSA-VVXF-R4VM-2VM6 Reflected XSS in querystring parameters

An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request. To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload. This will only affect projects...

PT-2022-24417 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.11 and earlier Description: The issue allows an attacker to inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a "/dev/build" or "/Security/login" request. ...

kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC

A vulnerability was found in the Linux kernel's KVM component related to the LAPIC during the guest reboot process. This issue arises when the SETLAPIC command is issued without exposing the tsc-deadline mode, leading to warnings and potential inconsistencies due to an unhandled preemption timer...

PT-2022-5440

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to a security feature bypass vulnerability in the Windows Mark of the Web mechanism, which is associated with errors in security settings. This vulnerability can be...

kernel: cifs: fix handlecache and multiuser

In the Linux kernel, the following vulnerability has been resolved: cifs: fix handlecache and multiuser In multiuser each individual user has their own tcon structure for the share and thus their own handle for a cached directory. When we umount such a share we much make sure to release the pinne...

CVE-2022-38199

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings...

Consensys: CSV Injection at https://assets-paris-demo.codefi.network/

Summary: Hi consensys Security Team. I have found CSV Injection when generate report at https://assets-paris-demo.codefi.network/ CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or...

OPENSUSE-SU-2022:10148-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: roundcubemail was updated to 1.5.3 Enigma: Fix initial synchronization of private keys Enigma: Fix double quoted-printable encoding of pgp-signed messages with no attachments 8413 Fix various PHP8 warnings 8392 Fix mail headers injection v...

The vulnerability of Mozilla Thunderbird’s email client, related to insufficient warnings about dangerous actions, allows a hacker to execute a spamming attack.

The vulnerability of Mozilla Thunderbird’s email client is related to insufficient warnings about dangerous actions. Exploiting this vulnerability could allow a malicious actor to perform a spamming attack remotely...

GSD-2022-1006153 netdevsim: Avoid allocation warnings triggered from user space

netdevsim: Avoid allocation warnings triggered from user space This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006027 netdevsim: Avoid allocation warnings triggered from user space

netdevsim: Avoid allocation warnings triggered from user space This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commit...

GSD-2022-1005784 irqchip/tegra: Fix overflow implicit truncation warnings

irqchip/tegra: Fix overflow implicit truncation warnings This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.138 by commit...

GSD-2022-1005617 netdevsim: Avoid allocation warnings triggered from user space

netdevsim: Avoid allocation warnings triggered from user space This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

GSD-2022-1005491 drm/meson: Fix overflow implicit truncation warnings

drm/meson: Fix overflow implicit truncation warnings This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

PT-2022-34285 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: The issue is related to the netdevsim component, which can trigger allocation warnings from user space. The actual impact and attack plausibility have not yet been proven. Recommendations:...

GSD-2022-1005409 drm/i915/display: avoid warnings when registering dual panel backlight

drm/i915/display: avoid warnings when registering dual panel backlight This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.66 by commit...

GSD-2022-1005272 netdevsim: Avoid allocation warnings triggered from user space

netdevsim: Avoid allocation warnings triggered from user space This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1004988 drm/i915/display: avoid warnings when registering dual panel backlight

drm/i915/display: avoid warnings when registering dual panel backlight This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.8 by commit...

PT-2025-18481

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, which prevented bpf program recursion for raw tracepoint probes. The issue was caused by a bpf program attached to the contention...