Windows Common Log File System Driver Elevation of Privilege Vulnerability

...

KLA19245 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, cause denial of service, obtain sensitive information, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote cod...

VulnCheck KEV: CVE-2022-37969

Microsoft Windows Common Log File System CLFS driver contains an unspecified vulnerability that allows for privilege escalation...

Microsoft Windows Common Log File System Driver 缓冲区错误漏洞

The Microsoft Windows Common Log File System Driver is Microsoft's Common Log File System CLFS API that provides a high-performance, general-purpose log file subsystem that can be used by specialized client applications and shared by multiple clients to optimize logging and access. access. A...

PT-2022-5571 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in memory in the Windows Common Log File System Driver, which can allow an attacker to execute arbitrary code with system privileges. It is a...

PT-2022-4788 · Microsoft · Windows Common Log File System Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Common Log File System Driver versions prior to 10.0.10240.19444 Windows Common Log File System Driver versions prior to 10.0.14393.5356 Windows Common Log File System Driver versions prior to the fixed version Description: The issue ...

CVE-2022-37969

Windows Common Log File System Driver Elevation of Privilege Vulnerability Recent assessments: cbeek-r7 at November 22, 2024 9:17am UTC reported: The vulnerability arises due to insufficient input validation in the CLFS driver. Specifically, CLFS mishandles certain crafted input, allowing an...

ovirt-log-collector: RHVM admin password is logged unfiltered

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality...

CVE-2022-2438

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$logfile' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that...

PT-2022-4704 · Cognex · Cognex 3D-A1000 Dimensioning System

Name of the Vulnerable Software and Affected Versions: Cognex 3D-A1000 Dimensioning System versions 1.0.3 3354 and prior Description: The issue is related to improper output neutralization for logs, which can be exploited by a remote attacker to create arbitrary log files. This can lead to the...

PT-2022-16657 · WordPress · Broken Link Checker

Name of the Vulnerable Software and Affected Versions: Broken Link Checker plugin for WordPress versions up to, and including 1.11.16 Description: The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the $log file value. This allows authenticated...

PT-2022-22148 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.0.0 up to and including 9.1.0.20 Dell PowerScale OneFS version 9.2.1.13 Dell PowerScale OneFS version 9.3.0.6 Dell PowerScale OneFS version 9.4.0.3 Description: The issue concerns the insertion of sensitive...

CVE-2022-39046

An issue was discovered in the GNU C Library glibc 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap...

Heap overflow

An issue was discovered in the GNU C Library glibc 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap...

CVE-2022-39046

An issue was discovered in the GNU C Library glibc 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap...

PT-2022-10086 · Ericsson · Ericsson Network Manager

Name of the Vulnerable Software and Affected Versions: Ericsson Network Manager versions prior to 21.2 Description: The issue allows users belonging to the same AMOS authorization group to retrieve data from certain log files, potentially leading to privilege escalation. All AMOS users are...

CVE-2022-29550

CVE-2022-29550 affects Qualys Cloud Agent 4.8.0-49 and concerns logging of ps auxwwe output to /var/log/qualys/qualys-cloud-agent-scan.log. The issue could expose credentials from environment variables in the log if verbose tracing is enabled; the vendor notes the ps data collection is intentiona...

PT-2022-19693 · Qualys · Qualys Cloud Agent

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent version 4.8.0-49 Description: An issue was discovered in Qualys Cloud Agent where it writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may unexpectedly write credentials from environmen...

[APPFW]"File too large" raises when upgrading appfw default signature "*Default Signatures"

Error "File too large" raises when to upgrade default signatures to version 89V89 On GUI Log sample could be seen in ns.log Jul 25 09:09:18 12 httpd: 49801 Netscalerip 127.0.0.1 - User nsroot - Remoteip 127.0.0.1 - Method POST - Command "params": "warning": "YES" "systemfile": "filename":...

OESA-2022-1825 kexec-tools security update

kexec-tools provides /sbin/kexec binary that facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. This package contains the /sbin/kexec binary and ancillary utilities that together form the userspace component of the kernel's kexec feature...