CVE-2022-21599

CVE-2022-21599 affects Oracle MySQL Server (Stored Procedure) in 8.0.30 and earlier. The vulnerability enables a high-privilege attacker with network access via multiple protocols to trigger a hang or crash of MySQL Server (DoS). Public advisories in the connected documents indicate this CVE is f...

RHEL 8 : .NET Core 3.1 (RHSA-2022:6912)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6912 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. N...

Design/Logic Flaw

A single malformed IEEE 802.15.4 Zigbee frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices...

CVE-2022-39065

CVE-2022-39065 affects IKEA TRÅDFRI gateway. A single malformed IEEE 802.15.4 (Zigbee) frame, delivered as an unauthenticated broadcast message, can unanchor the gateway , making connected lighting unresponsive to the IKEA Home Smart app and TRÅDFRI remote control. The vulnerability is exploitabl...

CVE-2022-39064

The CVE-2022-39064 issue affects IKEA TRÅDFRI smart lighting bulbs via a single malformed IEEE 802.15.4 (Zigbee) frame. A broadcast, unauthenticated Zigbee frame can cause the bulb to blink, and replaying the same frame multiple times can trigger a factory reset, causing loss of Zigbee network co...

.NET Core 3.1 security and bugfix update

3.1.424-1.0.1 - Add missing Oracle Linux Runtime IDs 3.1.424-1 - Update to .NET SDK 3.1.424 and Runtime 3.1.30 - Resolves: RHBZ2131728...

Security Updates for Microsoft .NET Core (October 2022)

A privilege escalation vulnerability exists in .NET core 6.0 6.0.10 and .NET Core 3.1 3.1.30. An authenticated, local attacker can exploit this, via the NuGet client, to cause the user to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on the...

NuGet Elevation of Privilege Vulnerability

Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0.0-rc, .NET 6.0, .NET Core 3.1, and NuGet NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol. This advisory also provides guidance on what developers can do to update their...

.NET Core 3.1 Update - October 11, 2022 (KB5019349)

None None...

WordPress WPvivid Backup Path Traversal Vulnerability

Wordpress plugin - WPvivid Backup - Version 0.9.76 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview Detailed description Timeline of disclosure Thanks & Acknowledgements Reference...

Security Bulletin: AIX is vulnerable to denial of service due to zlib and zlibNX (CVE-2018-25032)

Summary A vulnerability in zlib and zlibNX could allow a remote attacker to cause a denial of service CVE-2018-25032. AIX uses zlib and zlibNX as part of its data compression functions. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a...

AIX is vulnerable to denial of service due to zlib and zlibNX

IBM SECURITY ADVISORY First Issued: Wed Sep 28 13:38:50 CDT 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/zlibadvisory.asc https://aix.software.ibm.com/aix/efixes/security/zlibadvisory.asc...

GHSA-W9MF-83W3-FV49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release 18.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality...

Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release 18.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality...

AIX is vulnerable to arbitrary code execution and RPM database corruption and denial of service due to RPM.

IBM SECURITY ADVISORY First Issued: Fri Sep 23 09:39:22 CDT 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/rpmadvisory.asc https://aix.software.ibm.com/aix/efixes/security/rpmadvisory.asc...

DEBIAN-CVE-2022-39956

The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...

CVE-2022-39957

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

openSUSE 15 Security Update : virtualbox (openSUSE-SU-2022:10122-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10122-1 advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9787)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9787 advisory. - scsi: target: Fix WRITESAME No Data Buffer crash Mike Christie Orabug: 34419972 CVE-2022-21546 - rds: copyfromuser only once per rdssendmsg system ca...

.NET Denial of Service Vulnerability

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in ASP.NET...