Code injection

While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942...

CVE-2022-22496

While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942...

CVE-2022-22496

CVE-2022-22496 affects IBM Spectrum Protect Server 8.1.0.000–8.1.14 when a user account is being established and the installation is configured with SESSIONSECURITY=TRANSITIONAL. In this mode, it is susceptible to an offline dictionary attack that could expose credentials. The issue is documented...

PT-2022-5174

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.28 and prior Description The issue is related to insufficient input validation in the MySQL Server product, specifically in the Server: Data Dictionary component. This allows a high-privileged attacker with network...

PT-2022-11525

Name of the Vulnerable Software and Affected Versions PingID Mac Login versions prior to 1.1 Description A misconfiguration of RSA in PingID Mac Login is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. Recommendations For versions prior to 1.1, update to version 1...

CVE-2021-41995: Authentication Bypass Using an Alternate Path or Channel

A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass...

Ping Identity PingID Mac Login 授权问题漏洞

Ping Identity PingID Mac Login is an authentication application from Ping Identity USA. A security vulnerability exists in Ping Identity PingID Mac Login versions prior to 1.1, which stems from an RSA misconfiguration that is susceptible to a pre-computed dictionary attack, leading to an offline...

CVE-2022-22496: Improper Restriction of Excessive Authentication Attempts

While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942...

PT-2022-15474

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Server versions 8.1.0.000 through 8.1.14 Description The issue arises when a user account for the IBM Spectrum Protect Server is being established and configured to use SESSIONSECURITY=TRANSITIONAL. In this mode, it may be...

Security Bulletin: IBM Spectrum Protect Server vulnerable to offline dictionary and brute force attacks (CVE-2022-22496, CVE-2022-22487)

Summary The IBM Spectrum Protect Server is vulnerable to an offline dictionary attack when using SESSIONSECURITY=TRANSITIONAL. The IBM Spectrum Protect Storage agent is vulnerable to a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrati...

CVE-2022-22496

While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942...

ghostscript:gstoraster_fuzzer: Heap-buffer-overflow in pdfi_dict_get_no_store_R_inner

Detailed Report: https://oss-fuzz.com/testcase?key=5352861023731712 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gstorasterfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x631000060830 Crash State:...

MAL-2022-3286 Malicious code in gatsby-source-data-dictionary (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 609b9ce0046338f15cd270efb8914e5b4c3697afc1ac16fe9e0ac9d5ab9b2624 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Panchan: A New Golang-based Peer-To-Peer Botnet Targeting Linux Servers

A new Golang-based peer-to-peer P2P botnet has been spotted actively targeting Linux servers in the education sector since its emergence in March 2022. Dubbed Panchan by Akamai Security Research, the malware "utilizes its built-in concurrency features to maximize spreadability and execute malware...

GHSA-FX7F-RJQJ-52PJ Deserialization of Untrusted Data in Spring AMQP

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100%...

GHSA-H22X-HM8G-RXPG Improper Restriction of XML External Entity Reference in Apache OpenNLP

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache...

ROS-20220516-04

Vulnerability of QuerySet.explain function of Django web application software platform is related to failure to take measures to protect the SQL query structure. Exploitation of the vulnerability could allow an attacker, acting remotely, to affect the confidentiality, integrity and availability o...

CVE-2022-30048

Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter...

CVE-2022-1013

The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability...

CVE-2022-1013

The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability...