matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

Impact An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability...

Support Statement - Exchange Online Basic Authentication Deprecation

Purpose This article provides information on actions that must be taken to ensure Veeam Backup for Microsoft 365 will continue to function after the Basic Authentication Deprecation in Exchange Online. Associated Error Messages The following errors may be shown in Veeam Backup for Microsoft 365...

Cross-site Scripting (XSS)

Matrix Android SDK 2 is vulnerable to cross-site scripting.The vulnerability exists in multiple functions in MXMegolmDecryption.kt due to a protocol confusion in order to send fake to-device messages which allows an attacker to inject the key backup secret during a self-verification...

Type confusion

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a...

CVE-2022-39255 Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a...

Security Bulletin: AIX is vulnerable to denial of service due to zlib and zlibNX (CVE-2018-25032)

Summary A vulnerability in zlib and zlibNX could allow a remote attacker to cause a denial of service CVE-2018-25032. AIX uses zlib and zlibNX as part of its data compression functions. Vulnerability Details CVEID:CVE-2018-25032 DESCRIPTION: Zlib is vulnerable to a denial of service, caused by a...

CVE-2022-39248 matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion

matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker...

CVE-2022-22525

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function...

CVE-2022-22525

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function...

Input validation

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function...

CVE-2022-22525 Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function...

CVE-2022-40486

TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 574505553 was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file...

CVE-2022-40486

TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 574505553 was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file...

CVE-2022-40486

TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 574505553 was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file...

CVE-2022-40486

TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 574505553 was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file...

PT-2022-25402 · Tp Link · Tp Link Archer Ax10

Name of the Vulnerable Software and Affected Versions: TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 574505553 Description: The issue allows authenticated attackers to execute arbitrary code via a crafted backup file. Recommendations: For TP Link Archer AX10 V1 Firmware Versio...

Carlo Gavazzi UWP 输入验证错误漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management, and parking lot guidance. An input validation error vulnerability exists in Carlo Gavazzi UWP 3.0, which stems from a la...

TP-LINK AX10 代码注入漏洞

TP-LINK AX10 is a router from TP-LINK, China. TP-LINK AX10 version 1.3.1 is vulnerable to a code injection vulnerability, which stems from the ability to execute arbitrary code via a specially crafted backup file. An attacker could use this vulnerability to generate illegal code segments that...

Veritas Desktop and Laptop Option Cross-Site Scripting Vulnerability

Veritas Desktop and Laptop Option is a software from Veritas, USA that provides data backup and endpoint protection features for Windows and Mac desktops and laptops. The software supports network-less protection, instant backup, customized failover, self-service restore, and other protection...

WordPress Backup Scheduler Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...