PT-2022-26437 · Ibm · Sametime

Name of the Vulnerable Software and Affected Versions: Sametime versions 12 and later Description: The issue allows anonymous users to browse the User Directory and potentially create chats with internal users after logging in. Recommendations: For Sametime version 12 and later, consider disablin...

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061

Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations. In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only secret" visibility, community groups are visible to anonymous use...

Authentication Bypass

lava is vulnerable to authentication bypass. The vulnerability exists in lavaserver/lavatable.py due to improper input sanitization which allows an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server...

GHSA-463W-HXFV-G9F6 Apache Archiva vulnerable to Sensitive Information Disclosure via anonymous user

Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files. If anonymous read enabled, it's possible to read the database file directly without logging in...

CVE-2022-40308

If anonymous read enabled, it's possible to read the database file directly without logging in...

kernel: possible to use the debugger to write zero into a location of choice

A flaw was found in the kernel/debug/debugcore.c in the Linux kernel in lockdown mode. This flaw allows an attacker with local access to trigger the debugger, bypass lockdown and write anonymously...

grafana: CSRF vulnerability can lead to privilege escalation

A Cross-site request forgery CSRF vulnerability was found in Grafana. This flaw allows anonymous attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users for example, editors or admins. An attacker can exploit this vulnerability for...

PT-2022-25340 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva versions prior to 2.2.9 Description: The issue allows an anonymous user to read arbitrary files, including the database file, directly without logging in if anonymous read is enabled. Recommendations: For Apache Archiva version...

CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files

If anonymous read enabled, it's possible to read the database file directly without logging in...

CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files

If anonymous read enabled, it's possible to read the database file directly without logging in...

CVE-2022-40308 Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files

If anonymous read enabled, it's possible to read the database file directly without logging in...

Apache Archiva 安全漏洞

Apache Archiva is a suite of software from the Apache USA Foundation for managing one or more remote repositories. The software provides features such as remote Repository agents, role-based secure access management, and usage reporting. A security vulnerability exists in Apache Archiva versions...

grafana: CSRF vulnerability can lead to privilege escalation

A Cross-site request forgery CSRF vulnerability was found in Grafana. This flaw allows anonymous attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users for example, editors or admins. An attacker can exploit this vulnerability for...

EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2022-2717)

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The dtls1getmessagefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote...

QTIWorks 路径遍历漏洞

QTIWorks is a standards-based evaluation delivery software suite from Dave McKain's personal developer. A security vulnerability exists in versions of QTIWorks prior to QTIWorks 1.0-beta15 that stems from allowing users to upload QTI content packages as ZIP files, where the ZIP processing code do...

CVE-2022-24669 Anonymous users can register / de-register for configuration change notifications

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services...

CVE-2022-24669 Anonymous users can register / de-register for configuration change notifications

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services...

What Does The Fox Hack? Breaking Down the Anonymous Fox F-Automatical Script

While performing routine security research, one of our threat analysts discovered the latest version of a Command and Control C2 script, which is referred to as F-Automatical within the script’s code and was commonly known as FoxAuto in older versions. This is the seventh version of this automati...

Hot on the Trail of a Mass-School-Shooting Hoaxer

For months, an anonymous caller has terrorized communities around the US by reporting false shooting threats. We know how they did it. The question is, why?...

USN-5675-1 heimdal vulnerabilities

Isaac Boukris and Andrew Bartlett discovered that Heimdal's KDC was not properly performing checksum algorithm verifications in the S4U2Self extension module. An attacker could possibly use this issue to perform a machine-in-the-middle attack and request S4U2Self tickets for any user known by the...