CVE-2022-3182

CVE-2022-3182 affects Devolutions Remote Desktop Manager (DRDM) version 2022.2.14 and earlier, due to an Improper Access Control vulnerability in the Duo SMS two-factor authentication that allows bypassing the application lock. The issue is documented across multiple sources (including Red Hat an...

CVE-2022-39205 Access Control Bypass in Onedev

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

CVE-2022-39205 Access Control Bypass in Onedev

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the...

gpg: Signature spoofing via status line injection

A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

Shopware 安全漏洞

Shopware is a suite of open source e-commerce software from German company Shopware. A security vulnerability exists in Shopware version 5.7.14 and earlier versions, which stems from an ACL that can be bypassed by invoking the back-end management controller using a specific symbol...

SUSE SLES15 / openSUSE 15 Security Update : keepalived (SUSE-SU-2022:3232-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3232-1 advisory. - CVE-2021-44225: Fix a potential privilege escalation due to insufficient control in the D-Bus policy bsc1193115. Bugfixes: - Set...

OpenHarmony 授权问题漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation Foundation. A security vulnerability exists in OpenHarmony-v3.1.2 version and earlier versions, which can be exploited by LAN attackers to bypass distributed privilege control...

Ubuntu: Security Advisory (USN-5188-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-36118

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the SetProcessAttributes...

Blue Prism Enterprise 安全漏洞

Blue Prism Enterprise is an intelligent robotic process automation RPA software from Blue Prism UK. A security vulnerability exists in Blue Prism Enterprise versions 6.0 through 7.01 that originates in a misconfigured environment that exposes the Blue Prism application server, which allows an...

golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

A flaw was found in the go package of the cmd library in golang. The go command could be tricked into accepting a branch, which resembles a version tag. This issue could allow a remote unauthenticated attacker to bypass security restrictions and introduce invalid or incorrect tags, reducing the...

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

Summary: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Description: The following chunked request is processed. It should be rejected as Transfer-Encoding header obfuscatio...

EulerOS 2.0 SP5 : 389-ds-base (EulerOS-SA-2022-2264)

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that...

CVE-2022-33962

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings...

CVE-2022-33962

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings...

DEBIAN-CVE-2022-2164

Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted HTML page...

SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2295-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2295-1 advisory. - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send ...

openSUSE: Security Advisory for 389-ds (SUSE-SU-2022:2295-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:2295-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2021-4091: Fixed double free in psearch bsc1195324. - CVE-2022-1949: Fixed full access control bypass with simple crafted query bsc1199889...

CVE-2022-22472

IBM Spectrum Protect Plus Container Backup and Restore 10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session...