CVE-2022-1434

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipie...

Important: golang

Issue Overview: An out of bounds read vulnerability was found in golang. When using the archive/zip standard library stdlib and an unexpected file is parsed, it can cause golang to attempt to read outside of a slice array causing a panic in the runtime. A potential attacker can use this...

The vulnerability of the njs_function_frame_alloc() function in the njs interpreter of the nginx server allows attackers to compromise the confidentiality, integrity, and accessibility of information.

The vulnerability of the njsfunctionframealloc function in the njs interpreter of the nginx server is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of information...

The vulnerability of embedded software developed by Qualcomm, caused by buffer overflows, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of microprogramming software in embedded Qualcomm devices arises due to buffer overflows. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information as a result of incorrect input validation in the P...

The vulnerability of the kernel of the FireDTV driver in the Linux operating system allows a hacker to trigger an emergency shutdown of the system and compromise the confidentiality and integrity of the protected information.

The vulnerability of the FireDTV driver’s kernel in the Linux operating system arises due to an overflow in the buffer in the dynamic memory. Exploiting this vulnerability can allow an attacker to cause the system to crash and affect the confidentiality and integrity of the protected information...

The vulnerability of the CGI interpreter component for the PHP programming language allows attackers to disclose protected information, compromise data integrity, or cause service failures.

The vulnerability of the cgi component sapi/cgi/cgimain.c in the PHP programming language is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to disclose sensitive information, compromise data integrity, or cause service failures...

Security Bulletin: NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson TX1, Jetson TX2 Series (including Jetson TX2 NX) - April 2022

NVIDIA has released a software update for NVIDIA® Jetson AGX Xavier™ series, Jetson Xavier™ NX, Jetson TX1, Jetson TX2 series including Jetson TX2 NX in the NVIDIA JetPack™ software development kit SDK. The update addresses security issues that may lead to denial of service, escalation of...

NVIDIA Jetson 缓冲区错误漏洞

NVIDIA Jetson is an embedded system development module from NVIDIA. The NVIDIA Jetson Linux Driver Package suffers from a buffer error vulnerability that stems from insufficient validation of untrusted data, which could be exploited by a local attacker to cause a memory buffer overflow that could...

Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2022-1491)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1491 advisory. 1:1.8.0.332.b09-1 - Update to shenandoah-jdk8u332-b09 GA - Update release notes for 8u332-b09. - Switch to GA mode for final release. - This tarball is...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-44716, CVE-2021-44717)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled memory consumption in the header canonicalization cache in net/http. By sending HTTP/2 requests, a...

SUSE SLES15 Security Update : dnsmasq (SUSE-SU-2022:1288-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1288-1 advisory. - A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface,...

SUSE SLES11 Security Update : dnsmasq (SUSE-SU-2022:14941-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14941-1 advisory. - CVE-2021-3448: Fixed a potential DNS cache poisoning issue due to a constant outgoing port being used when for certain use cases of the...

The vulnerability of the ECDSA digital signature algorithm implementation in Oracle Java SE software and the Oracle GraalVM Enterprise Edition virtual machine allows a perpetrator to compromise the confidentiality, integrity, and accessibility of information.

The vulnerability of the ECDSA digital signature algorithm implementation in Oracle Java SE software and the Oracle GraalVM Enterprise Edition virtual machine is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to compromise th...

The vulnerability of Cisco Umbrella cloud security service arises from a flaw in the data protection mechanism, allowing attackers to compromise the integrity of the protected information.

The vulnerability of Cisco Umbrella cloud security service is related to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the integrity of the protected information by loading specially created malicious payloads...

puppet: unsafe HTTP redirect

An exposure flaw was found in Puppet Agent and Puppet Server where HTTP credentials were leaked. When the HTTP redirects occurred, the authentication and cookie header was added when following redirects to a different host. This flaw allows an unauthorized network attacker to access sensitive...

Removing Provider could lead to no provider at all

Lines of code Vulnerability details Impact When removing a provider you don't verify that there is at least one provider left. If no provider is left, then no price data can be reported. Proof of Concept 1 Tools Used hardhat test Recommended Mitigation Steps Add a checks on the length of the...

The vulnerability of the Display Key Combination Switches in the Wayland server display protocol implementation allows a hacker to compromise data integrity or cause service failures.

The vulnerability of the Display Key Combination Demon in the Wayland display protocol implementation relates to the ability to save the PID of a process in the /tmp/swhks.pid file and incorporate the PID of an existing process into it. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the `ext/standard/var_unserializer.re` component in the PHP programming language allows a attacker to compromise data integrity.

The vulnerability of the ext/standard/varunserializer.re component in the PHP programming language lies in the use of memory after it is freed. Exploiting this vulnerability allows an attacker to compromise data integrity...

DEBIAN-CVE-2022-21449

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows...

CVE-2022-21416

Vulnerability in the Oracle Solaris product of Oracle Systems component: Utility. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful...