EulerOS Virtualization 3.0.6.6 : glibc (EulerOS-SA-2022-2501)

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The nameserver caching daemon nscd in the GNU C Library aka glibc or libc6 2.29 through 2.33, when processing a request for netgro...

Security Bulletin: NVIDIA CUDA Toolkit - October 2022

NVIDIA has released a software update for NVIDIA® CUDA® Toolkit software. This update addresses security issues that may lead to code execution, denial of service, or information disclosure. To protect your system, download and install this software update from the CUDA Toolkit Downloads page. Go...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A logic error vulnerability exists in the processing of business logic in the Huawei HarmonyOS home screen module, which can be exploited by an attacker to...

The vulnerability of the strcpy() function in Netgear Nighthawk AC1900 R7000 wireless router software allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the strcpy function in Netgear Nighthawk AC1900 R7000 wireless router software lies in the fact that the write operation goes beyond the buffer boundaries into memory when processing the binary file wl. Exploiting this vulnerability could allow an attacker to compromise the...

Vulnerabilities in web browsers Firefox, Firefox ESR, and the email client Thunderbird, related to resource management errors, allow attackers to compromise the confidentiality and integrity of protected information.

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird is related to resource management errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of information that is loaded from subresources...

The vulnerability of the strcpy() function in Netgear N300 wireless router microprogramming software allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the strcpy function implementation in Netgear N300 wireless router microprogramming software WNR2000v4 is related to the issue of writing operations beyond the buffer boundaries when processing configuration files for uHTTPd web servers. Exploiting this vulnerability allows a...

Security Bulletin: Due to use of IBM® SDK Java™ Technology Edition, IBM Virtualization Engine TS7700 is vulnerable to a data integrity threat (CVE-2022-21496)

Summary IBM Virtualization Engine TS7700 is vulnerable to a data integrity threat CVE-2022-21496 due to the use of IBM® SDK Java™ Technology Edition, Version 8. The SDK is used by the TS7700 to provide the Management Interface, to perform cache management, and to provide Transparent Cloud Tiering...

SUSE SLES15: dpdk / dpdk-devel / dpdk-kmp-default / dpdk-thunderx / etc (SUSE-SU-2022:3429-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3429-1 advisory. - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs bsc1202903. - CVE-2022-2819...

Security Bulletin: Vulnerabilities in FasterXML Jackson Databind and Apache Xerces affect IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments may be affected by the below FasterXML Jackson Databind and Apache Xerces vulnerabilities CVEs. Vulnerability Details CVEID:CVE-2020-25649 DESCRIPTION:...

The vulnerability of the PgBouncer connection pool program in PostgreSQL allows for unauthorized access to sensitive data. By not properly securing the SQL query structure, attackers can gain access to confidential information, compromise its integrity, and cause service failures.

The vulnerability of the PostgreSQL PgBouncer connection pool program lies in the fact that the data received from the initial request message is treated as already decoded data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity,...

The vulnerability of the rcp.c component in the NetKit-rsh remote execution program allows a attacker to compromise data integrity.

The vulnerability of the rcp.c component in the NetKit-rsh remote execution program is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise data integrity using a dummy file name or the file name “.”...

Security Vulnerabilities fixed in Thunderbird 102.3.1 — Mozilla

Thunderbird users who use the Matrix chat protocol were vulnerable to an impersonation attack. A malicious server administrator could fake encrypted messages to look as if they were sent from another user on that server. Thunderbird users who use the Matrix chat protocol were vulnerable to an...

PT-2022-5875 · D Link · D-Link Dnr-322L

Name of the Vulnerable Software and Affected Versions: D-Link DNR-322L versions 2.60B15 and earlier Description: The issue is related to a data integrity failure in the 'Backup Config' feature, allowing an authenticated attacker to execute OS level commands on the device. This can be exploited by...

SUSE SLES15: dpdk / dpdk-devel / dpdk-doc / dpdk-examples / dpdk-kmp-default / etc (SUSE-SU-2022:3390-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3390-1 advisory. - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs bsc1202903. -...

Security Bulletin: IBM Tivoli Federated Identity Manager OpenID: signature validation not applied to all attributes (CVE-2012-6359)

Abstract SUMMARY An OpenID message can be modified to contain unsigned attributes that will be accepted by a relying party because Tivoli Federated Identity Manager TFIM does not check that all attributes have been signed. Content VULNERABILITY DETAILS CVE: CVE-2012-6359 DESCRIPTION: An OpenID...

The vulnerability of the Vim text editor’s command line allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Vim text editor’s command line interface is related to the lack of measures to clean input data. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability in the findfile.c component of the Vim text editor allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the findfile.c component of the Vim text editor is related to the improper handling of CTR-W f when the file name is absent. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the LibreOffice office software package, related to errors in the certificate validation process, allows a perpetrator to compromise the integrity of data.

The vulnerability of the LibreOffice office software package is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2022-2367)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Informix JDBC Java API Documentation Frame Injection Vulnerability (CVE-2013-1571)

Abstract Java API Documentation contains a frame injection vulnerability. Content CVEID: CVE-2013-1571 DESCRIPTION: HTML documentation generated by the Javadoc tool contains a security vulnerability. The vulnerability allows an attacker to craft a malicious link to the documentation which injects...