CVE-2022-41952 Uncontrolled Resource Consumption in Matrix Synapse

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after maxspidersize default: 10M bytes have been downloaded, which can in some cases lead to...

CVE-2022-41776

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allow an attacker to provide new values for user configuration files such as UserListInfo.xml. This could lead to the changing of administrativ...

CVE-2022-24669 Anonymous users can register / de-register for configuration change notifications

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services...

Honeywell Safety Manager 访问控制错误漏洞

Honeywell Safety Manager is used by Honeywell to minimize accidents, maximize production uptime, reduce compliance costs, and manage plant safety. An access control error vulnerability exists in all versions of Honeywell Safety Manager that stems from the use of the Security Builder protocol, whi...

CVE-2022-30245

Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the...

Honeywell Alerton Ascent Control Module 安全漏洞

The Honeywell Alerton Ascent Control Module is a high performance, BACnet-compliant, integrated building controller and router from USAHoneywell. It can support BACnet/Ethernet, BACnet/IP and BACnet/MSTP. A security vulnerability exists in Honeywell Alerton Ascent Control Module ACM version...

Phoenix Contact Classic Line Industrial Controllers

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC 131 ETH, ILC 131 ETH/XC, ILC 151 ETH, ILC 151 ETH/XC, ILC 171 ETH 2TX, ILC 191 ETH 2TX, ILC 191 ME/AN, and AXC 1050 Vulnerability: Missing Authentication for Critical...

Insecure default value for CORS configuration

Impact The default value for the CORSENABLED and CORSORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. Patches The default values for CORS have been changed in...

VulnCheck KEV: CVE-2022-23134

Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend...

Debian DLA-2914-1 : zabbix - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2914 advisory. - After the initial setup process, some steps of setup.php file are reachable not only by super- administrators, but by unauthenticated users as well. Malicious actor can...

CVE-2022-23601 CSRF token missing in Symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the...

DEBIAN-CVE-2022-23134

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

Design/Logic Flaw

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

CVE-2022-23134 Possible view of the setup pages by unauthenticated users if config file already exists

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

CVE-2021-29847

CVE-2021-29847 affects IBM Power System BMC/firmware on POWER8 OP825 family (S821LC 8001-12C, OP825.50). The issue arises from a configuration change that allows an authenticated user to open an insecure communication channel, enabling an attacker to obtain sensitive information via a man-in-the-...

Security Bulletin: Vulnerabilities in IBM Db2 affect IBM Spectrum Protect Server (CVE-2021-29777, CVE-2021-20579, CVE-2021-29703, CVE-2020-4885, CVE-2020-4945)

Summary The IBM Spectrum Protect Server may be affected by IBM Db2 vulnerabilities such as denial of service, obtaining sensitive information, accessing or changing Db2 configuration, and overwriting arbitrary files. Vulnerability Details CVEID: CVE-2021-29777 DESCRIPTION: IBM Db2 for Linux, UNIX...

The vulnerability of the microprogrammed software in Emerson WirelessHART Gateways of the 1420, 1410D, and 1410 series wireless hardware routers stems from the lack of access control checks. This allows attackers to circumvent security restrictions, gain unauthorized access to protected information, and alter settings.

The vulnerability of the microprogrammed software in Emerson WirelessHART Gateways models 1420, 1410D, and 1410 is related to the lack of access control checks during system backup restoration. Exploiting this vulnerability can allow an attacker to bypass security restrictions, gain unauthorized...

Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP Edition appliance Security Update

Vulnerabilities have been discovered in Citrix ADCformerlyknown asNetScaler ADC,Citrix Gateway formerlyknown asNetScaler Gateway,and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO.These vulnerabilities,if exploited,could result in the following security issues: CVE-ID|...

CVE-2021-24752

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctpswitch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement...

OPENSUSE-SU-2021:3325-1 Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues: - CVE-2021-32718: Fixed improper neutralization of script-related HTML tags in a web page basic XSS in management UI bsc1187818. - CVE-2021-32719: Fixed improper neutralization of script-related HTML tags in a web page basic XSS in...