NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Vulnerability (NS-SA-2022-0017)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by a vulnerability: - A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest thre...

CVE-2022-1631 Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain...

CVE-2022-1631

The CVE-2022-1631 issue affects microweber/microweber before v1.2.15, described across multiple sources as an OAuth misconfiguration that enables account takeover. The root cause is the lack of email confirmation and insufficient validation of emails from social login providers, allowing an attac...

CVE-2022-1631 Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain...

NewStart CGSL CORE 5.05 / MAIN 5.05 : libwebp Multiple Vulnerabilities (NS-SA-2022-0039)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libwebp packages installed that are affected by multiple vulnerabilities: - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in PutLE16. The highest threat from this vulnerability...

NewStart CGSL MAIN 6.02 : linuxptp Vulnerability (NS-SA-2022-0054)

The remote NewStart CGSL host, running version MAIN 6.02, has linuxptp packages installed that are affected by a vulnerability: - A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an...

NewStart CGSL CORE 5.05 / MAIN 5.05 : pki-core Multiple Vulnerabilities (NS-SA-2022-0029)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pki-core packages installed that are affected by multiple vulnerabilities: - A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not...

NewStart CGSL MAIN 6.02 : libwebp Multiple Vulnerabilities (NS-SA-2022-0065)

The remote NewStart CGSL host, running version MAIN 6.02, has libwebp packages installed that are affected by multiple vulnerabilities: - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow was found in PutLE16. The highest threat from this vulnerability is to data...

NewStart CGSL CORE 5.05 / MAIN 5.05 : samba Vulnerability (NS-SA-2022-0034)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has samba packages installed that are affected by a vulnerability: - A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code that performs this had a flaw...

NewStart CGSL MAIN 6.02 : xorg-x11-server Multiple Vulnerabilities (NS-SA-2022-0049)

The remote NewStart CGSL host, running version MAIN 6.02, has xorg-x11-server packages installed that are affected by multiple vulnerabilities: - An integer overflow leading to a heap-buffer overflow was found in The X Input Method XIM client was implemented in libX11 before version 1.6.10. As pe...

PT-2022-14015 · Google +1 · G-Suite +1

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.15 Description: The issue allows an attacker to create an account in the application using a victim's email, as there is no email confirmation. This enables the attacker to gain pre-authentication t...

NewStart CGSL CORE 5.05 / MAIN 5.05 : xorg-x11-server Vulnerability (NS-SA-2022-0036)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has xorg-x11-server packages installed that are affected by a vulnerability: - A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege...

CVE-2021-44717

There's a flaw in golang's syscall.ForkExec interface. An attacker who manages to first cause a file descriptor exhaustion for the process, then cause syscall.ForkExec to be called repeatedly, could compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked...

CVE-2021-26390

A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data...

rsyslog8 -- heap buffer overflow on receiving TCP syslog

Rainer Gerhards reports: Modules for TCP syslog reception have a heap buffer overflow when octet-counted framing is used. The attacker can corrupt heap values, leading to data integrity issues and availability impact. Remote code execution is unlikely to happen but not impossible...

Adiscon Rsyslog 安全漏洞

Adiscon Rsyslog is a library for collecting syslogs from the German company Adiscon. A security vulnerability exists in Adiscon Rsyslog version 8.2204.0 and earlier versions, which stems from a heap buffer overflow in the module used to receive TCP syslogs when using octet-counted frames, which c...

Design/Logic Flaw

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipie...

CVE-2022-1434

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipie...

CVE-2022-1434

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipie...

CVE-2022-1434

The CVE-2022-1434 issue affects the RC4-MD5 ciphersuite in OpenSSL 3.0, where the AAD data is incorrectly used as the MAC key, allowing an attacker to modify data in transit without decrypting it. The vulnerability requires both endpoints to negotiate RC4-MD5, and it is not exploitable when TLSv1...