CVE-2022-31257

The CVE-2022-31257 issue affects Mendix-based applications: Mendix 7 (before 7.23.31), Mendix 8 (before 8.18.18), and Mendix 9 (before 9.14.0, including 9.12 before 9.12.2 and 9.6 before 9.6.12). The root cause is an improper access control that allows bypassing password validations when an activ...

Siemens Mendix Applications

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: Mendix Applications Vulnerability: Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a malicious user to leak sensitive information if the...

SAP S/4HANA 输入验证错误漏洞

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from the German company SAP. SAP S/4HANA is vulnerable to an input validation error that stems from a lack of input validation in the management checkbook component, which could be exploited ...

Rethinking Vulnerability Management in a Heightened Threat Landscape

Mariano Nunez, CEO, Onapsis Repeated warnings from CISA and the Biden Administration on the Russian cyber threat over the last several months have heightened the state of alertness for U.S. agencies and businesses across industries, which are expecting ‘tit-for-tat’ cyberattacks from Russia in...

SUSE: Security Advisory (SUSE-SU-2022:2342-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Multiple MediaTek Chips Autoboot Access Control Error Vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

The vulnerability of the RegexRequestMatcher component in the Spring Security Java framework allows attackers to escalate their privileges.

The vulnerability of the RegexRequestMatcher component in the Spring Security Java framework, which is used for securing industrial applications, is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

SUSE SLES15 Security Update : MozillaFirefox (SUSE-SU-2022:2279-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2279-1 advisory. - If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object...

Fedora: Security Advisory for dotnet3.1 (FEDORA-2022-cd37732349)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Multiple MediaTek Chip WLAN Driver Input Validation Error Vulnerability

MediaTek Inc. is the world's fourth largest fab-based semiconductor company and a leader in the markets of mobile terminals, smart home applications, wireless connectivity and Internet of Things IoT products, with approximately 1.5 billion units of end products with built-in MediaTek chips hittin...

The vulnerability of the modular interface between web servers and web applications in Rack, related to improper input validation, allows attackers to execute DoS attacks.

The vulnerability of the modular interface between web servers and web applications in Rack is related to insufficient validation of data entered by users during the analysis of complex POST requests. Exploiting this vulnerability allows a malicious actor to execute a DoS attack using a specially...

SUSE: Security Advisory (SUSE-SU-2022:2313-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: dotnet3.1-3.1.420-1.fc35

.NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of...

[SECURITY] Fedora 36 Update: dotnet3.1-3.1.420-1.fc36

.NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of...

Oracle Linux 9 : java-17-openjdk (ELSA-2022-1729)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1729 advisory. 1:17.0.3.0.7-1 - April 2022 security update to jdk 17.0.3+7 - Update to jdk-17.0.3.0+7 tarball - Update release notes to 17.0.3.0+7 - Add missing...

SUSE: Security Advisory (SUSE-SU-2022:2298-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-31127 Improper handling of email input in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

EFB Tampering. Holdover Time

TL;DR Holdover applications are a relatively new method of calculating the effectiveness of anti-icing fluid sprayed onto aircraft wings. Applications such as these have additional attack surfaces as the developer and source databases need to be considered Airlines often view limits as targets to...

SUSE: Security Advisory (SUSE-SU-2022:2267-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

This Week in Spring - July 5th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This weeks all sorts of weird for me. Its Tuesday! But here in the US we just celebrated the 4th of July, and I, like many Americans, took a long weekend. Took some time with the family to do a little road trip up north to...