PT-2022-24143 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: The issue concerns certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which disclosure of potentially sensitive...

CVE-2022-32877

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-32877

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-32877

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-32877

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data...

MGASA-2022-0294 Updated nodejs packages fix security vulnerability

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have bee...

dotCMS 跨站脚本漏洞

dotCMS is a content management system CMS from the United States dotCMS. The system supports modules such as RSS feeds, blogs, forums, etc. and is easy to extend and build. A cross-site scripting vulnerability exists in dotCMS versions 5.2 and later, which stems from a configuration issue that...

The license server found at this address is not compatible with this version of Citrix provisioning

Issue when connecting license server on Citrix Provisioning Configuration Wizard. The license server found at this address is not compatible with this version of Citrix provisioning...

CVE-2022-30550

CVE-2022-30550 affects Dovecot 2.2 and 2.3 before 2.3.20. When two passdb entries share the same driver and args, incorrect username_filter and mechanism settings can be applied to passdb definitions, leading to an unintended security configuration and potential privilege escalation in certain se...

Login schema unable to be configured and the SELECT button grayed out

When configuring nFactor authentication, user is unable to select login schema xml in GUI page. The "SELECT" button is greyed out. Like below screenshot...

Design/Logic Flaw

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by...

SSL Scan from https://myssl.com/ Reports ADC SSL vServer TLS 1.3 is Disabled

If you perform an SSL scan fromhttps://myssl.com/, sometimes it reports TLS1.3 is disabled even if ADC vServer is correctly configured...

PUB-A-211647233

In onCreate of VzwSetupActivity.java, there is a possible bypass of carrier network restrictions through ESIM due to a missing configuration check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-MRFM-JXGF-2H6V Elasticsearch Improper Access Control vulnerability

The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...

Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members

Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page...

PT-2022-9992 · Qualcomm · Snapdragon Connectivity +4

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to a possible assertion due to improper validation of TCI configuration in various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon...

Apple iOS和Apple iPadOS 输入验证错误漏洞

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices and Apple iPadOS is an operating system for iPad tablets. Apple iOS and Apple iPadOS are vulnerable to an input validation error, which stems from The vulnerability is caused b...

CVE-2022-21654 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...

CVE-2022-23630

Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled ...

Design/Logic Flaw

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.74, D7000v2 before 1.0.0.53, D7800 before 1.0.1.56, D8500 befor...