Potential leak of NuGet.org API key

Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET Core 3.1, NuGet NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0. This advisory also provides guidance on what...

Code injection

The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socket to be closed and freed while it was still in use by another portion of the kernel. An attack with local access can operate on the socket...

CVE-2022-21504

CVE-2022-21504 affects Oracle UEK 6 U3, where a missing file descriptor count in UEK6 U3 can lead to a use-after-free-like condition: a socket’s descriptor may be closed/freed while still in use, allowing local access to cause a denial of service. The CVE is documented with CVSS 3.1 base score 5....

CVE-2022-32258

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure...

CVE-2022-32256

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information...

CVE-2022-32253

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker...

CVE-2022-32255

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information...

CVE-2022-29034

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting XSS attacks...

CVE-2022-32254

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker...

CVE-2022-32256

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information...

CVE-2022-32253

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker...

CVE-2022-27221

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...

Microsoft .NET Core和Microsoft Visual Studio 安全漏洞

Microsoft Visual Studio and Microsoft .NET Core are both products of Microsoft Corporation. Microsoft Visual Studio is a family of development tool suites and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle. Microsoft .NET...

PT-2022-21179 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified due to improper input validation, which could allow the OpenSSL certificate's password to be printed to a file reachable by an attacker...

PT-2022-21186 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A misconfiguration has been identified in the APT update of the affected application. This issue could allow an attacker to add insecure packages to the application...

PT-2022-21181 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified in the SINEMA Remote Connect Server, where a web service lacks proper access control for some endpoints, potentially leading to unauthorized...

PT-2022-21177 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A missing authentication verification for a resource used to change the roles and permissions of a user has been identified. This could allow an attacker to change the permissio...

PT-2022-7019 · Microsoft +7 · Net 6.0 +8

Name of the Vulnerable Software and Affected Versions: .NET Core versions prior to 3.1.29 .NET 6.0 versions prior to 6.0.9 Description: A denial of service issue exists due to incorrect resource cleanup, allowing a remote attacker to cause a stack overflow by sending a customized payload during...

PT-2022-21180 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified that could expose sensitive user information. This occurs when a customized HTTP POST request forces the application to write the status of a...

PT-2022-21182 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A vulnerability has been identified in the SINEMA Remote Connect Server, where the web service lacks proper access control for some endpoints. This could lead to low privileged...