Multiple vulnerabilities in OMRON CX-Programmer

Overview CX-Programmer provided by Omron Corporation contains multiple vulnerabilities listed below. Use-after-free CWE-416 - CVE-2022-43508, CVE-2023-22277, CVE-2023-22317, CVE-2023-22314 Out-of-bounds Write CWE-787 - CVE-2022-43509 Stack-based Buffer Overflow CWE-121 - CVE-2022-43667 Michael...

OMRON CX-Programmer

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Omron Equipment : CX-Programmer Vulnerabilities : Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device or may allow arbitrary code execution. 3. TECHNICAL DETAILS...

PT-2022-25421

FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update packages through its auto-update mechanism. An attacker suitably positioned on the network could intercept the update request and deliver a...

Zoom Client 5.7.3 < 5.11.6 Privilege Escalation

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. Note that Nessus has not tested fo...

CVE-2022-28757

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28757

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

Design/Logic Flaw

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28757

CVE-2022-28757 affects Zoom Client for Meetings on macOS (Standard and IT Admin) versions 5.7.3–5.11.6. The root cause is a vulnerability in the auto-update mechanism due to improper verification of cryptographic signatures, allowing a local low-privileged user to escalate to root. Exploitation d...

CVE-2022-28757 Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28757: Insufficient Verification of Data Authenticity

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

PT-2022-4374 · Zoom · Zoom Client For Meetings

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings for macOS versions 5.7.3 through 5.11.6 Description: The issue is related to a vulnerability in the auto update process, which could allow a local low-privileged user to escalate their privileges to root. This is due ...

CVE-2022-28757

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28756

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

Input validation

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28756 Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28756: Improper Verification of Cryptographic Signature

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

CVE-2022-28756

The Zoom Client for Meetings for macOS Standard and for IT Admin starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

PT-2022-4162 · Zoom · Zoom Client For Meetings

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings for macOS versions 5.7.3 through 5.11.5 Description: The issue is related to a vulnerability in the auto update process, specifically due to incorrect cryptographic signature verification. This could allow a local...

Zoom’s Auto-Update Feature Came With Hidden Risks on Mac

The popular video meeting app makes it easy to keep the software up to date—but it also introduced vulnerabilities...

Tobesoft Nexacro数据伪造问题漏洞

Tobesoft Nexacro is a unified framework-based OSMU single-source multi-purpose application development solution from Tobesoft Korea. A security vulnerability previously existed in Nexacro version 17 17.1.3.700, which stemmed from the automatic update feature not validating input data other than...