GitHub

Impact
A bug was found in containerd’s CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memor…

Description
An ExecSync request runs a command in a container and returns the output to the Kubelet. It is used for readiness and liveness probes within a pod. The way CRI-O runs ExecSync commands is through conmon. CRI-O asks conmon to start the proce…

Impact
For a subset of Omnipay gateways (those that use intermediary states like isNotification() or isRedirect()), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment be…

Impact
It was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files.
The issue was discovered by the maintainer. There were no reports of the vulnerability
being known to or exploited by a third party, before the rel…

Impact
when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation…

Impact
Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access.
Only users using TiDB 5.3.0 are affected by this vulnerability….

Impact
When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory.
Patches
Users of the trilogy gem should …

Background
CILogon is a federated auth provider that allows users to authenticate
themselves via a number of Identity Providers (IdP), focused primarily on educational and
research institutions (such as Universities). More traditional and open IdPs
suc…

FacturaScripts 2022.08 and prior is vulnerable to cross-site scripting. A patch is available on the master branch of the repository and anticipated to be part of version 2022.09.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-1988
https://github…

An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
References

https://nvd.nist.gov/vuln/det…