CVE-2022-24797 Exposure of Sensitive Information in Pomerium

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

CVE-2022-24797 Exposure of Sensitive Information in Pomerium

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

CVE-2022-22965

A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively affected from Spring Beans, using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain...

Old sessions not blocked by login enable function in Snipe-IT

Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using t...

PT-2022-2256 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.3 through 14.7.6 GitLab CE/EE versions 14.8 through 14.8.4 GitLab CE/EE versions 14.9 through 14.9.1 Description: The issue is related to improper handling of user input, allowing an attacker to exploit a stored XSS by...

CVE-2022-24790

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. Thi...

Design/Logic Flaw

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. Thi...

CVE-2022-24790 HTTP Request Smuggling in puma

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. Thi...

CVE-2022-24790

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. Thi...

CVE-2022-24790 HTTP Request Smuggling in puma

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. Thi...

PT-2022-18876 · Unknown +2 · Antispoof Extension +2

Name of the Vulnerable Software and Affected Versions: Mediawiki versions through 1.37.1 Description: An issue was discovered in the AntiSpoof extension where the check for the override-antispoof permission is incorrect. Recommendations: For versions through 1.37.1, as a temporary workaround,...

Security Bulletin: An vulnerability in IBM Websphere Liberty affect IBM Spectrum LSF Suite and IBM Platform Application Center

Summary There is an vulnerability CVE-2021-39038in IBM Websphere Liberty used by IBM Spectrum LSF Suite and IBM Platform Application Center . Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

GHSA-47WV-VHJ2-G66M Use of insecure temporary file in Horovod

Impact The insecure tempfile.mktemp is used when Horovod is run in an LSF job with jsrun. In that situation, a jsrun rank file is created with mktemp, which could be hijacked by another process to read or manipulate the content. This issue does not impact the use of MPI, Gloo, Spark or Ray. Patch...

PT-2022-2283 · Swhkd · Swhkd

Name of the Vulnerable Software and Affected Versions: SWHKD versions 1.1.5 and prior Description: The issue is related to the use of the /tmp/swhkd.pid pathname by the SWHKD daemon, which can lead to information leaks or denial of service. This is because the /tmp directory is accessible to all...

Unrestricted Upload of File with Dangerous Type in Gogs

Impact The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled default are affected. Patches Repository file uploads are prohibited to its .git directory. Users should upgra...

PT-2025-7996 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17.0-rc8+ Description: A vulnerability in the Linux kernel has been resolved, related to the btrfs filesystem. The issue occurs when the btrfs get blocks direct write function reserves temporary outstanding...

PT-2022-18716 · Tesla · Tesla Vehicles

Name of the Vulnerable Software and Affected Versions: Tesla vehicles through 2022-03-26 Description: The issue allows attackers to open the charging port of certain Tesla vehicles via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. It is noted that the...

Security Bulletin: Cross Site Scripting may affect IBM Business Automation Workflow and IBM Case Manager (ICM) - CVE-2020-4768

Summary IBM Case Manager and IBM Business Automation Workflow may be vulnerable to a cross site scripting attack. Vulnerability Details CVEID: CVE-2020-4768 DESCRIPTION: IBM Case Manager and IBM Business Automation Workflow are vulnerable to cross-site scripting. This vulnerability allows users t...

UBUNTU-CVE-2022-24778

The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function CheckAuthorization is supposed to check whether the current used is...

PT-2022-17387 · Unknown · Surveyking

Name of the Vulnerable Software and Affected Versions: SurveyKing version 0.2.0 Description: The issue allows attackers to login to the system and access data using the browser cache when the user exits the application, due to the retention of users' session cookies after logout. Recommendations:...