rdiffweb version 2.4.1 is set to a default and leaks error information. Version 2.4.2 fixes this issue.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-3175
https://huntr.dev/bounties/c40badc3-c9e7-4b69-9e2e-2b9f05865159
https://github.com/ikus06…
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are …
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are…
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-1278
https://bugzilla.redhat.com/show_bug.cgi?id=2073401
https:/…
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-40635
https://…
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-40634
https://docs.c…
rdiffweb prior to 2.4.2 has no password policy or password checking, which could make users vulnerable to brute force password guessing attacks. Version 2.4.2 enforces minimum and maximum password lengths.
References
https://nvd.nist.gov/vuln/detail/C…
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files which are not correctly base 64 encoded are treated as a fatal error and causes Routinator to exit. Worst case impact o…
LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69. A patch is available at commit ca938740264f1fcb18f91cba8e4039c518ecb75b.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-38497
https://githu…
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c. Commit 0033b6312fd311b2e45e379c04a83d77c1e58578 contains a patch.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-38495
https…
