CVSS: 6.5EPSS: 4%CPEs: 11EXPL: 1CVE-2022-35256 – nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
https://notcve.org/view.php?id=CVE-2022-35256
18 Oct 2022 — The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. El analizador llhttp en el módulo http en Node v18.7.0 no maneja correctamente los campos de encabezado que no terminan con CLRF. Esto puede resultar en tráfico ilegal de solicitudes HTTP. A vulnerability was found in NodeJS due to improper validation of HTTP requests. • https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3550 – X.org Server xkb.c _GetCountedString buffer overflow
https://notcve.org/view.php?id=CVE-2022-3550
17 Oct 2022 — A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051. • https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 17EXPL: 0CVE-2022-3545 – Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free
https://notcve.org/view.php?id=CVE-2022-3545
17 Oct 2022 — A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to this vulnerability. • https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=02e1a114fdb71e59ee6770294166c30d437bf86a • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-3551 – X.org Server xkb.c ProcXkbGetKbdByName memory leak
https://notcve.org/view.php?id=CVE-2022-3551
17 Oct 2022 — A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052. • https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2 • CWE-401: Missing Release of Memory after Effective Lifetime CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3517 – nodejs-minimatch: ReDoS via the braceExpand function
https://notcve.org/view.php?id=CVE-2022-3517
17 Oct 2022 — A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. Se ha encontrado una vulnerabilidad en el paquete minimatch. Este fallo permite una Denegación de Servicio por Expresión Regular (ReDoS) cuando es llamada a la función braceExpand con argumentos específicos, resultando en una Denegación de Servicio A vulnerability was found in the nodejs-minimatch ... • https://github.com/grafana/grafana-image-renderer/issues/329 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.1EPSS: 0%CPEs: 16EXPL: 1CVE-2022-3564 – Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
https://notcve.org/view.php?id=CVE-2022-3564
17 Oct 2022 — A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. • https://github.com/Trinadh465/linux-4.1.15_CVE-2022-3564 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 2CVE-2022-41751 – Debian Security Advisory 5294-1
https://notcve.org/view.php?id=CVE-2022-41751
17 Oct 2022 — Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option. Jhead versión 3.06.0.1, permite a atacantes ejecutar comandos arbitrarios del Sistema Operativo al colocarlos en un nombre de archivo JPEG y usando después la opción de regeneración -rgt50 It was discovered that Jhead did not properly handle certain crafted images while rotating them. An attacker could possibly use this issue to crash Jhead, resulting in a denial... • https://github.com/Matthias-Wandel/jhead • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 2.6EPSS: 0%CPEs: 5EXPL: 0CVE-2022-3521 – Linux Kernel kcm kcmsock.c kcm_tx_work race condition
https://notcve.org/view.php?id=CVE-2022-3521
16 Oct 2022 — A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec7eede369fe5b0d085ac51fdbb95184f87bfc6c • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3524 – Linux Kernel IPv6 ipv6_renew_options memory leak
https://notcve.org/view.php?id=CVE-2022-3524
16 Oct 2022 — A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c52c6bb831f6335c176a0fc7214e26f43adbd11 • CWE-401: Missing Release of Memory after Effective Lifetime CWE-404: Improper Resource Shutdown or Release •
CVSS: 8.1EPSS: 0%CPEs: 10EXPL: 1CVE-2022-41674 – kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans()
https://notcve.org/view.php?id=CVE-2022-41674
13 Oct 2022 — An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. Se ha detectado un problema en el kernel de Linux versiones hasta 5.19.11. Los atacantes capaces de inyectar tramas WLAN podrían causar un desbordamiento del búfer en la función ieee80211_bss_info_update en el archivo net/mac80211/scan.c A buffer overflow flaw was found in the u8 overflow in cfg80211_update_notlisted_... • http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •