Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Several vulnerabilities were discovered in Squid, a fully featured web proxy cache, which could result in exposure of sensitive information in the cache manage…
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via performance.getEntries() (CVE-20…
regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879) net/http/ht…
Multiple vulnerabilities have been discovered in virglrenderer, the worst of which could result in remote code execution.
Linux's Wi-Fi code has some nasty bugs, which can be exploited simply by being near an attacker. Remote code execution is a possibility''no need to actually co…
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null …
The mailcap module does not add escape characters into commands discovered in the system mailcap file. (CVE-2015-20107) Allows an attacker to set up a maliciou…
It was discovered that there was a potential arbitrary file read vulnerability in twig, a PHP templating library. It was caused by insufficient validation of t…
It was discovered that there was a potential denial of service vulnerability in strongswan, an IPsec VPN solution. Strongswan could have queried URLs with untr…
There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist…
It was discovered that there was a potential SQL injection vulnerability in libpgjava, a Java library for connecting to PostgreSQL databases.
expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security issue(s), including the impact, a CVSS sco…
squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318) For more details about the security issue(s), including the impact, a CVSS score, ackno…
kitty could be made to run programs if it opened a specially crafted image or desktop notification.
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutd…
Security fix for CVE-2022-36944. See https://github.com/scala/scala/releases/tag/v2.13.9 for other changes in scala 2.13.9.
Security fix for CVE-2022-36944. See https://github.com/scala/scala/releases/tag/v2.13.9 for other changes in scala 2.13.9.
Denial of service attack via crafted regular expressions. (CVE-2022-40023) References: - https://bugs.mageia.org/show_bug.cgi?id=30878 - https://ubuntu.com/sec…
Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint. CVE-2022-37797
A heap-based buffer overflow vulnerability was discovered in gdal, a Geospatial Data Abstraction Library, which could result in denial of service or potentiall…
Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of servi…
Sandipan Roy discovered two vulnerabilities in InfoZIP's unzip program, a de-archiver for .zip files, which could result in denial of service or potentially th…
A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine (CVE-2022-31676). Referenc…
Malicious actors such as Kinsing are taking advantage of both recently disclosed and older security flaws in Oracle WebLogic Server to deliver cryptocurrency-m…
