‼ CVE-2022-23649 ‼
📖 Read
via "National Vulnerability Database".
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio. If an attacker has access to the signature in OCI, they can manipulate cosign into believing the entry was stored in Rekor even though it wasn't. The vulnerability has been patched in v1.5.2 of Cosign. The `signature` in the `signedEntryTimestamp` provided by Rekor is now compared to the `signature` that is being verified. If these don't match, then an error is returned. If a valid bundle is copied to a different signature, verification should fail. Cosign output now only informs the user that certificates were verified if a certificate was in fact verified. There is currently no known workaround.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29655 ‼
📖 Read
via "National Vulnerability Database".
Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29656 ‼
📖 Read
via "National Vulnerability Database".
Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23645 ‼
📖 Read
via "National Vulnerability Database".
swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23650 ‼
📖 Read
via "National Vulnerability Database".
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-0371 ‼
📖 Read
via "National Vulnerability Database".
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25134 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25130 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25131 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-45082 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25133 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25135 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25132 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23642 ‼
📖 Read
via "National Vulnerability Database".
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25137 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25136 ‼
📖 Read
via "National Vulnerability Database".
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-44302 ‼
📖 Read
via "National Vulnerability Database".
BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidu_map parameters in /user/ztconfig.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25365 ‼
📖 Read
via "National Vulnerability Database".
Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-24980 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0409 ‼
📖 Read
via "National Vulnerability Database".
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-25366 ‼
📖 Read
via "National Vulnerability Database".
Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable.📖 Read
via "National Vulnerability Database".