The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.

CVE-2022-0537

Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.



**Description**

In phpIPAM 1.4.5, a normal user with the role of User could download or export IP subnets that may contain sensitive information related data such as IP address, IP state, MAC, owner, hostname and device via export-subnet.php endpoint. The bug is the export-subnet.php should verify the user has at least read permission to the subnet it is exporting and it does not.

**Proof of Concept**

Tested version: phpIPAM 1.4.5

Parameter: subnetId

Steps to reproduce:

1 Login as user with the role of User.

2 Go to http://{HOST}/app/subnets/addresses/export-subnet.php?subnetId=1&ip_addr=on&state=on&description=on&hostname=on&firewallAddressObject=on&mac=on&owner=on&switch=on&port=on&note=on&location=on&filename=phpipam_subnet_export.xls

3 We can export any related subnet data by changing subnetId parameter value with any running number such as 1, 2, 3 and so forth.

**Impact**

This vulnerability is capable of Improper Access Control and sensitive data exposure of related party.

CVE-2022-1223: Improper Access Control in phpipam

An issue in provider/libserver/ECKrbAuth.cpp of Kopano-Core v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired.

Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    *   Explore
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   *   For
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    *   By Solution
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    *   Case Studies
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    *   Repositories
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

*   Overview
*   Repositories
*   Packages
*   People

**Pinned**

1.  Read-only mirror of Kopano Core git repo
    
    C++ 50 29
    

3.  Read-only mirror of the Kopano WebApp git repo
    
    JavaScript 19 22
    
4.  Material from the Kopano workshop at the 2021 Univention Summit
    
    Shell 1
    

**Repositories**

Type

Select type

All Public Sources Forks Archived Mirrors Templates

Language

Select language

All C# C++ Go HTML JavaScript PHP Python Shell TypeScript

Sort

Select order

Last updated Name Stars

*   kcc-go Public
    
    This implements a minimal client interfacing with a couple of SOAP methods of a Kopano server.
    
    Go 0 Apache-2.0
    
    3 0 3
    
    Updated Mar 4, 2023
    
*   kopano-webapp Public
    
    Read-only mirror of the Kopano WebApp git repo
    
    JavaScript
    
    19 22 0 5
    
    Updated Mar 2, 2023
    
*   oidc-go Public
    
    Oidc-go is a Go package to provide common helpers to interface with OpenID Connect servers.
    
    Go
    
    2
    
    Apache-2.0
    
    1 0 1
    
    Updated Feb 25, 2023
    
*   kwmserver Public
    
    Kopano Web Meetings Server implements the signaling/channelling server for Kopano Web Meetings
    
    Go
    
    5 3 1 3
    
    Updated Feb 24, 2023
    
*   libkcoidc Public
    
    This project implements a C shared library with a public API to validate Kopano Konnect tokens (JSON Web Tokens).
    
    Go 0 0
    
    2 2
    
    Updated Feb 24, 2023
    
*   kapi Public
    
    Kopano API provides a web service with the endpoints to interface with Kopano via HTTP APIs.
    
    Go
    
    3
    
    0
    
    0 1
    
    Updated Feb 15, 2023
    
*   pubsjs Public
    
    Kopano API Pubs Client Library (pubsjs)
    
    TypeScript 0 MIT 0
    
    0 16
    
    Updated Jan 7, 2023
    
*   kwmjs Public
    
    Kopano Web Meetings Client Library (kwmjs)
    
    TypeScript
    
    1
    
    MIT 0
    
    0 11
    
    Updated Jan 7, 2023
    
*   kpop Public
    
    Kpop is a collection of React UI components and UI uitilites for Kopano Web apps
    
    JavaScript 0 Apache-2.0
    
    1 0 17
    
    Updated Dec 10, 2022
    
*   meet Public
    
    A PWA for doing video meetings
    

**Most used topics**

CVE-2022-26562: Kopano

An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.

*   Edit Task

*   Mute Notifications
*   Protect as security issue
*   Award Token
*   Flag For Later

Risk Rating

Low

Author Affiliation

Wikimedia Communities

*   Mentions

**Event Timeline**

Restricted Application added a subscriber: Aklapper.

Dylsss renamed this task from FileImporter allows imports to cascade protected files when the importer does not have administartor permissions to FileImporter allows imports to cascade protected files when the importer does not have administrator permissions.

WMDE-Fisch set the point value for this task to 3.

sbassett renamed this task from FileImporter allows imports to cascade protected files when the importer does not have administrator permissions to FileImporter allows imports to cascade protected files when the importer does not have administrator permissions (CVE-2022-28206).

sbassett triaged this task as Low priority.

sbassett changed Author Affiliation from N/A to Wikimedia Communities.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed Risk Rating from N/A to Low.

Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL

CVE-2022-28206: ⚓ T294256 FileImporter allows imports to cascade protected files when the importer does not have administrator permissions (CVE-2022-28206)

An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.

One of the checks for 'override-antispoof' permission in the AntiSpoof extension is inverted, here: https://github.com/wikimedia/mediawiki-extensions-AntiSpoof/blob/7a5fc55dc31a0ab654a80a0fa6293027293c5b7c/includes/AntiSpoofPreAuthenticationProvider.php#L145

This might not be a real security issue – it looks like the faulty code path is only used for displaying UI messages (JS checks on Special:CreateAccount), and not for actually creating accounts. But I didn't go through everything to prove that for sure, so I'm filing as a security task just in case.

It's also not reproducible on Wikimedia wikis, because the anti-spoof checks there are handled by code in CentralAuth, which doesn't have the bug: https://github.com/wikimedia/mediawiki-extensions-CentralAuth/blob/061b493dc96a874bb49e1e67c10e416fce6040be/includes/CentralAuthPrimaryAuthenticationProvider.php#L512

This has been introduced in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AntiSpoof/+/618623, by accidentally removing a ! to negate a condition.

I discovered the problem while testing a patch for T167163.

CVE-2022-28209: ⚓ T304126 One of the checks for 'override-antispoof' permission is inverted (CVE-2022-28209)

Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.

变更日志如下：

*   新增 resources 目录。
*   新增游客访问设置，可设定展示静态页、展示自宝义内容或重定向到指定链接。
*   新增秘密登录设置，可设定密钥有效期。
*   合并或修复来自 burpheart/NexusPHP\_safe 及 CVE 网站上列出的一些安全隐患。
*   修复邮件乱码。

resources 目录用于存放一些资源文件，如模版。

游客访问，支持以下 4 种配置：

*   正常。也即默认的正常访问。
*   展示静态页面。展示存放于 resources/static-pages/ 目录下的静态页面。
*   展示自定义内容。通过富文本编辑要展示给游客的内容。
*   重定向到指定 URL。进行重定向操作。

秘密登录，启用后需要通过 URL 传递密钥参数才可登录。这里参数名为 secret。

**文章导航**

CVE-2020-24771: NexusPHP v1.6.0-beta2 – NexusPHP

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[day\] \[month\] \[year\] \[list\]

Date: Tue, 25 Jan 2022 17:55:25 +0000
From: Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>
To: oss-security@...ts.openwall.com
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
 Dave Airlie <airlied@...il.com>, Daniel Vetter <daniel@...ll.ch>,
 Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Marian Rehak <mrehak@...hat.com>
Subject: Linux kernel: Security sensitive bug in the i915 kernel driver​ (CVE-2022-0330)


\[This is a public disclosure of an issue reported 7 days ago to 
linux-distros at openwall. CVE-2022-0330 has been assigned to the 
issue since.\]

Hi all,

A missing GPU TLB flush has been discovered in the i915 kernel driver 
which could be exploited by malicious userspace and can manifest in two 
flavours, depending on whether the GPU is running behind an active IOMMU 
(address translation) or not:

1. IOMMU with address translation - malicious userspace can trigger DMAR 
read/write faults getting logged to the kernel log.

2. Without an active IOMMU malicious userspace can gain access (from the 
code executing on the GPU) to random memory pages.

Second case is therefore the serious one.

It is currently not known whether specific memory could be targeted, but 
random memory corruption or data leaks are a known possibility.

Underlying reason for the access to memory not owned is a missing TLB 
flush upon releasing memory which used to back a GPU buffer object back 
to the system.

Flawed assumption was that flushing the TLB at the start of every 
userspace GPU execution is sufficient, given the programming model where 
userspace is expected to declare which graphics virtual memory address 
ranges it will be accessing at the start of every execution. However 
what was not considered is that userspace can legitimately (it is 
allowed in uapi) \_not\_ declare those accesses.

This allows userspace to continue GPU access to memory, while the kernel 
driver (i915) is unaware of it being in use, and therefore is allowed to 
release the backing store back to the system. Should the system then 
give out those pages back for a different use, the exploit situation can 
arise.

Return of the pages back to the system can either be specifically 
engineered by the malicious software, or can happen innocently via 
system memory pressure.

All Intel integrated and discrete GPUs starting from Gen8 (Broadwell) 
are affected.

Fix has already been developed and consists of explicitly flushing the 
TLBs before releasing memory back to the system for any GPU buffer 
objects which were in use from the GPU.

Note that this will have a varying performance impact depending on the 
specific GPU, GPU workload and overall system workload.

Fix for the issue has been provided to the Linus distributions and Linux 
kernel maintainers and is expected to be merged to top of the tree and 
stable and LTS releases shortly. Fix carries the title of "drm/i915: 
Flush TLBs before releasing backing store".

Kind regards,

Tvrtko

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2022-0330: security - Linux kernel: Security sensitive bug in the i915 kernel driver​ (CVE-2022-0330)

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[day\] \[month\] \[year\] \[list\]

Date: Thu, 10 Feb 2022 14:16:41 +0000
From: Samuel Page <samuel.page@...gate.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2022-0435: Remote Stack Overflow in Linux Kernel TIPC Module
 since 4.8 (net/tipc)


Immunity Security Advisory

CVE-2022-0435: A Remote Stack Overflow in The Linux Kernel


========================================================================
Contents
========================================================================

Summary
Analysis
Further Information
Remediation
Acknowledgements
Disclosure Timeline


========================================================================
Summary
========================================================================

We discovered a remotely & locally reachable stack overflow in the Linux
kernel networking module for the Transparent Inter-Process
Communication (TIPC) protocol.

While the module can be found in most major distributions, it must be
loaded in order to be exploited. Furthermore, for remote exploitation
the target would need to have a TIPC bearer set up already i.e.
vulnerability extends to systems using TIPC.

Exploitation is trivial and can lead to denial of service via kernel
panic. In the absence, or bypass, of stack canaries/KASLR the
vulnerability can lead to control flow hijacking with an arbitrary
payload.

The vulnerability has been present since the introduction of the TIPC
monitoring framework in kernel version 4.8.

- Introduced: commit 35c55c9877f8 ("tipc: add neighbor monitoring framework")
- Fixed: https://github.com/torvalds/linux/commit/9aa422ad326634b76309e8ff342c246800621216

========================================================================
Analysis
========================================================================

Transparent Inter Process Communication (TIPC) is an IPC mechanism
designed for intra-cluster communication. Cluster topology is managed
around the concept of nodes and the links between these nodes.

One of the many features of the TIPC module is its monitoring framework.
Introduced into the kernel in June 2016 (commit 35c55c9), the framework
allows nodes to monitor network topology and share their view with other
nodes in the same domain.

Peer state is tracked via \`struct tipc\_peer\`:

...
    /\* struct tipc\_peer: state of a peer node and its domain
     \* @addr: tipc node identity of peer
     \* @head\_map: shows which other nodes currently consider peer 'up'
     \* @domain: most recent domain record from peer
     \* @hash: position in hashed lookup list
     \* @list: position in linked list, in circular ascending order by 'addr'
     \* @applied: number of reported domain members applied on this monitor list
     \* @is\_up: peer is up as seen from this node
     \* @is\_head: peer is assigned domain head as seen from this node
     \* @is\_local: peer is in local domain and should be continuously monitored
     \* @down\_cnt: - numbers of other peers which have reported this on lost
     \*/
    struct tipc\_peer {
        u32 addr;
        struct tipc\_mon\_domain \*domain;
        struct hlist\_node hash;
        struct list\_head list;
        u8 applied;
        u8 down\_cnt;
        bool is\_up;
        bool is\_head;
        bool is\_local;
    };
...

\`struct tipc\_mon\_domain\` referends a domain record, used to define that
peers view of the TIPC topology:

...
    #define MAX\_MON\_DOMAIN       64
    ...

    /\* struct tipc\_mon\_domain: domain record to be transferred between peers
     \* @len: actual size of domain record
     \* @gen: current generation of sender's domain
     \* @ack\_gen: most recent generation of self's domain acked by peer
     \* @member\_cnt: number of domain member nodes described in this record
     \* @up\_map: bit map indicating which of the members the sender considers up
     \* @members: identity of the domain members
     \*/
    struct tipc\_mon\_domain {
        u16 len;
        u16 gen;
        u16 ack\_gen;
        u16 member\_cnt;
        u64 up\_map;
        u32 members\[MAX\_MON\_DOMAIN\];
    };
...

These records are transferred between peers, with each node keeping a
copy of the most up-to-date domain record received from each of its
peers in the \`tipc\_peer->domain\` field.

Records are processed by the function \`tipc\_mon\_rcv\`, which check
\`STATE\_MSG\` received from peers, to see if the message body contains a
valid \`struct tipc\_mon\_domain\`:

...
    /\* tipc\_mon\_rcv - process monitor domain event message
     \*
     \* @data: STATE\_MSG body
     \* @dlen: STATE\_MSG body size (taken from TIPC header)
     \*/
    void tipc\_mon\_rcv(struct net \*net, void \*data, u16 dlen, u32 addr,
        struct tipc\_mon\_state \*state, int bearer\_id)
    {
        ...
        struct tipc\_mon\_domain \*arrv\_dom = data;
        struct tipc\_mon\_domain dom\_bef;
        ...

        /\* Sanity check received domain record \*/                        \[0\]
        if (dlen < dom\_rec\_len(arrv\_dom, 0))                             \[1\]
            return;
        if (dlen != dom\_rec\_len(arrv\_dom, new\_member\_cnt))               \[2\]
            return;
        if (dlen < new\_dlen || arrv\_dlen != new\_dlen)                    \[3\]
            return;
        ...

        /\* Drop duplicate unless we are waiting for a probe response \*/
        if (!more(new\_gen, state->peer\_gen) && !probing)                 \[4\]
            return;
        ...

        /\* Cache current domain record for later use \*/
        dom\_bef.member\_cnt = 0;
        dom = peer->domain;
        if (dom)                                                         \[5\]
            memcpy(&dom\_bef, dom, dom->len);                             \[6\]

        /\* Transform and store received domain record \*/
        if (!dom || (dom->len < new\_dlen)) {
            kfree(dom);
            dom = kmalloc(new\_dlen, GFP\_ATOMIC);                         \[7\]
            peer->domain = dom;
            if (!dom)
                goto exit;
        }
...

The function does some basic sanity checks \[0\] to make sure that a) the
message body actually contains a domain record and b) does it contain a
valid \`struct tipc\_mon\_domain\`.

Where \`data\` is the message body and \`dlen\` is the length of the \`data\`
taken from the message header, the function checks:

- the length of \`data\` is enough to at least hold an empty record \[1\]
- the length of \`data\` matches the expected size of a domain record
  given the provided \`member\_cnt\` field \[2\]
- the length of \`data\` matches the provided \`len\` field \[3\]

Later we fetch the sending peers \`struct peer\` to see if we've already
received a domain record from them \[5\]. If we have, we want to
temporarily cache a copy of the old record to do a comparison later \[6\].

Then, satisfied it's a new and valid record, we'll update the
\`struct peer->domain\` field with the new info. If it's the first domain
record, we'll make a new \`kmalloc\`ation for this \[7\], or if it's larger
than the last one we'll reallocate it.

-----------------
The Vulnerability
-----------------

The vulnerability lies in the fact that during the initial sanity
checks, the function doesn't check that \`member\_cnt\` is below
MAX\_MON\_DOMAIN which defines the maximum size of the \`members\` array.

By pretending to be a peer node and establishing a link with the target,
locally or remotely, we're able to first submit a malicious domain
record containing an arbitrary payload; so long as the len/member\_cnt
fields match up for the sanity checks, this will be kmallocated fine.

Next, we can send a newer domain record which will cause the previous
malicious record to be memcpy'd into a 272 bytes local
\`struct tipc\_mon\_domain\` &dom\_bef \[6\] triggering a stack overflow.

This allows us to overwrite the contents of the stack following
&dom\_bef with our arbitrary members buffer from the malicious domain
record submitted first; the size of which is constrained by the media
MTU (Ethernet, UDP, Inifiband)


========================================================================
Further Information
========================================================================

For a more in-depth analysis, including additional TIPC background, we
will be posting up a follow-up blog to compliment this advisory.

Regarding exploitation, after time has been given for patching and
remediation we will also release a further post discussing exploitation.

Further information will be posted over at https://twitter.com/immunityinc/

========================================================================
Remediation
========================================================================

This vulnerability has been present since the monitoring framework was
first introduced in June 2016, impacting versions 4.8 forward.

The patch below was introduced in commit 9aa422ad3266, so updating your
system to include this patch is the best way to mitigate CVE-2022-0435,
including an additional u16 overflow spotted by Eric Dumazet.

The TIPC module must be loaded for the system to be vulnerable,
furthermore to be targeted remotely the system needs to have a TIPC
bearer enabled. If you don't need to use TIPC or are unsure if you are,
you can take the following steps:

- \`$ lsmod | grep tipc\` will let you know if the module is currently
  loaded,
- \`modprobe -r tipc\` may allow you unload the module if loaded,
  however you may need to reboot your system
- \`$ echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf\`
  will prevent the module from being loaded, which is a good idea if you
  have no reason to use it

If you need to use TIPC and can't immediately patch your system, look to
enforce any configurtions that prevent or limit the ability for
attackers to imitate nodes in your cluster. Options include TIPC
protocol level encryption, IPSec/MACSec, network seperation etc.

It's also worth noting that the current \`CONFIG\_FORTIFY\_SRC=y\` is a hard
mitigation to leveraging CVE-2022-0435 for control-flow hijacking, as it
does a bounds check on the size of the offending memcpy and causes a
kernel panic.


========================================================================
Acknowledgements
========================================================================

I'd like to thank the maintainers of the TIPC module, as well as members
of the security@...nel.org and linux-distros@...openwall.org for their
help and work throughout the disclosure process.

I would also like to mention the vulnerability research done on TIPC
previously by SentinelLabs with their work on CVE-2021-43267 and other
security researchers for publishing their findings on TIPC exploitation.

- https://www.sentinelone.com/labs/tipc-remote-linux-kernel-heap-overflow-allows-arbitrary-code-execution/
- https://haxx.in/posts/pwning-tipc/

========================================================================
Disclosure Timeline
========================================================================

- 27/01/2022: Vulnerability & fix suggestion reported
- 05/02/2022: The patch is finalised
- 10/02/2022: Coordinated release date (14:00 GMT)

The information contained in this electronic mail is confidential information intended only for the use of the individual(s) or entity(s) named. If the reader of the message is not the addressee (or authorized to receive for the addressee), you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and/or by telephone and destroy the original message.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2022-0435: security - CVE-2022-0435: Remote Stack Overflow in Linux Kernel TIPC Module since 4.8 (net/tipc)

A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-25574: douphp · Issue #1 · aqianhei/aqian

phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.

**Nossos números:**

**3,5MM+**Anomalias reportadas  
aos clientes em 2020**450+**Pessoas em Recife, São  
Paulo, Rio e Londres**500+**Clientes no Brasil, UK,  
LATAM e Europa**21+**Anos de experiência  

**Principais Serviços**

 

**Security Consulting**

Projetos de avaliações, testes e diagnósticos de resiliência e cibersegurança.

Saiba Mais

 

**Security Integration**

Desenhamos, instalamos e configuramos as soluções de segurança próprias e de parceiros, respeitando o fluxo do seu negócio.

Saiba Mais

 

**Managed Security Services**

Temos inteligência, tecnologias e profissionais altamente qualificados para apoiar sua empresa com projetos contínuos.

Saiba Mais

 

**Digital Identity**

O AllowMe agrega proteção e confiança à relação digital entre empresas e seus clientes.

Saiba Mais

**Trabalhamos com importantes parceiros de negócios para oferecer as melhores ferramentas em cibersegurança.**

Nosso portfólio de ponta a ponta inclui as soluções tecnológicas mais inovadoras do mercado desenvolvidas pelos maiores fabricantes internacionais.

Saiba mais

Assine nossa newsletter

Cadastre-se para receber novidades

Tag

#php